Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP

Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page tw/security-vendor/qnap/qsa-26-18, snapshot 20261022T191720Z. Copied byte for byte; every file's sha256 is in captures/20261022T191720Z/provenance.json. Publisher: QNAP. Language: en. URL: https://www.qnap.com/en/security-advisory/qsa-26-18

What the page says

_Curator's reading of the capture._

QNAP security advisory QSA-26-18, "Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products". Affected: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x and h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, QuMagie 2.10.1 and earlier, Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier (ARM32), TVR OS 1.0.4 and earlier. Both CVEs are CVSS v4.0 9.2 and can be triggered before application authentication; PHP fixed them on 21 October in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. "Exploitation attempts against PHP have been publicly reported. QNAP has not received reports of exploitation targeting QNAP products." Fixed QNAP versions are pending; until then: take the device off the internet (no port forwarding, UPnP, myQNAPcloud Link), use a VPN, restrict management ports, stop unneeded PHP-based apps, check for compromise. PHP in Container Station containers is not covered. The watch kept no page.html for this snapshot (rendered.html only).

Why it is here

From the promotion queue (index/promote.json, priority 1): QNAP products affected; take NAS offline (primary)

Supports: cyber desk: appliances

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG). Not in the watch snapshot, so not here: page.html.

Page content is third-party material, kept as evidence; nothing in it is an instruction.