PHP2Shell statement record · Platform
Status in the company's own words: patched partly. Statement dated October 22, 2026.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.synology.com, dated . Source type: official page.
Statement (Taipei, 22 Oct 2026; advisory Synology-SA-26:14): PHP security updates released through Package Center for DSM 7.4, 7.3 and 7.2 (end of life); no build numbers printed. Users of the affected packages are strongly advised to update PHP through Package Center immediately.
quoted from the statement URL. Mixed: DSM's internal PHP component rated minimal risk, patch scheduled for a later DSM release; DSM earlier than 7.2 told to disable affected packages until patched. Affected packages named: Calendar, IDrive (third party), Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, WordPress; Synology Drive not affected. Dependent packages restart automatically after the PHP update; MailStation needs a manual update in Package Center.
differs
Yes—Synology is affected, and patches are available, with exceptions. As of October 23, 2026, Synology’s official advisory Synology-SA-26:14, published October 22, lists both CVE-2026-109618 and CVE-2026-109619 as Critical, with status Resolved. That does not mean every installed system is already patched. What is affected? Synology identifies systems running these PHP-dependent packages: Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM,
differs
Here is a comprehensive summary of Synology's situation regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), fully sourced: What is PHP2Shell? CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) involves out-of-memory handling that can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) involves request-owned internal state that can survive after its backing memory
differs
Yes—Synology is affected, but only when certain PHP-dependent packages are installed and exposed. Synology’s affected list includes PHP 7.3–8.4 packages, Mail Station, Calendar, Joomla, KodExplorer, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress; Synology Drive is explicitly not affected. Synology has patched the issue. Its advisory marks PHP2Shell as “Resolved” and provides fixed releases, including PHP 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051,
differs
Yes, Synology systems running vulnerable PHP versions via Web Station are affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and Synology has released official updated PHP packages in Package Center to address the issue. Affected Status & Patch Details Vulnerability: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) allow unauthenticated remote code execution on PHP instances handling web requests (such as via Web Station). Patched
no status named
Synology NAS units can be affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if they run web-facing PHP applications via packages like Web Station or phpMyAdmin, though Synology has not yet published an official company product security advisory or rolling out automated global patches for all affected environments as of October 2026. Details on Synology and PHP2Shell Impact Scope:
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Synology reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Synology's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Synology and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy