# Source: Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

QNAP: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP

**QNAP** · [https://www.qnap.com/en/security-advisory/qsa-26-18](https://www.qnap.com/en/security-advisory/qsa-26-18) · published 2026-10-22 (release date on the page) · added by `curator@php.newsroom` · slug `qnap-qsa-26-18`

Promoted from the source watch (oq9gflln), snapshot 20261022T191720Z. QNAP products affected; take NAS offline (primary)

## What it says, as the collector read it

#### Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products - Security Advisory | QNAP

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `tw/security-vendor/qnap/qsa-26-18`, snapshot `20261022T191720Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191720Z/provenance.json`. Publisher: QNAP. Language: en. URL: https://www.qnap.com/en/security-advisory/qsa-26-18

#### What the page says

_Curator's reading of the capture._

QNAP security advisory QSA-26-18, "Vulnerabilities in PHP (PHP2Shell) Affecting Multiple QNAP Products". Affected: QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0, h6.0.x and h5.2.11 and earlier, QuTScloud c5.2.9 and earlier, QuMagie 2.10.1 and earlier, Note Station 3 3.9.14 and earlier, QNE (ADRA) 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier (ARM32), TVR OS 1.0.4 and earlier. Both CVEs are CVSS v4.0 9.2 and can be triggered before application authentication; PHP fixed them on 21 October in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. "Exploitation attempts against PHP have been publicly reported. QNAP has not received reports of exploitation targeting QNAP products." Fixed QNAP versions are pending; until then: take the device off the internet (no port forwarding, UPnP, myQNAPcloud Link), use a VPN, restrict management ports, stop unneeded PHP-based apps, check for compromise. PHP in Container Station containers is not covered. The watch kept no page.html for this snapshot (rendered.html only).

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): QNAP products affected; take NAS offline (primary)

Supports: cyber desk: appliances

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG). Not in the watch snapshot, so not here: page.html.

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T191720Z · HTTP 202 · https://www.qnap.com/en/security-advisory/qsa-26-18- `headers.json` aa08aaebb6e26e71a93712249fa6ad431e8d910a925ae174fa44959c2321f018 739 bytes
- `provenance.json` 9ed0a563b1c7b28729c903b027ae9f66d5e825faa7b14caab83cf5c699111d72 1,555 bytes
- `rendered.html` a49d81def04843e1e2bf1e474dfd384989bb9eeb992dc1cb33ca624a08fa4c42 209,652 bytes
- `screenshot.jpg` 775851d837e4ee7b5e48ca2f7be725c84564336a7f215265a5861185023bc955 401,134 bytes
- `text.txt` 45f3ae53efc4028d20fc6d29bf21d91f84ff1bf962beef861d70be6f72d04593 7,261 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/qnap-qsa-26-18/index.html