# Source: QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

QNAP: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP

**QNAP** · [https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance](https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance) · published 2026-10-22 (dateline Taipei) · added by `curator@php.newsroom` · slug `qnap-statement-php2shell`

Promoted from the source watch (oq9gflln), snapshot 20261022T191720Z. QNAP PSIRT saw scanning and attack attempts (primary)

## What it says, as the collector read it

#### QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance | QNAP

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `tw/security-vendor/qnap/statement-php2shell`, snapshot `20261022T191720Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191720Z/provenance.json`. Publisher: QNAP. Language: en. URL: https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance

#### What the page says

_Curator's reading of the capture._

QNAP's press statement on PHP2Shell (CVSS v4.0 9.2, patched by PHP on 21 October). QNAP PSIRT launched a cross-functional response and is reviewing all products and cloud services. It states that QNAP PSIRT "has observed scanning activity and exploitation attempts targeting these vulnerabilities in the wild", and that it "detected and successfully blocked attempted attacks against QNAP's official website and online store, as well as its cloud services". It points to advisory QSA-26-18 for products.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): QNAP PSIRT saw scanning and attack attempts (primary)

Supports: cyber desk: appliances; exploitation

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T191720Z · HTTP 200 · https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance- `headers.json` c253a6f6b0a50935f373029d625f1816fe441abf971eae8fab073bd5ddd84df6 5,433 bytes
- `page.html` 6d7e8996b605faaaa6df09930f6790a531f355fbe2fe16f5ffef4c1e93ebb781 169,112 bytes
- `provenance.json` 5bde08241c094606508438d02703564d9ee44a9f24dff12bd8d67a88dba8840e 1,790 bytes
- `rendered.html` 70a37c635627cbe7026e77c82a9d45f14fd116c035e5e8fb06787c951812aa94 200,745 bytes
- `screenshot.jpg` 4c6ebb3a51a831ef15bcb4d9b250468467353cce02251de6b8eda4e444665fad 320,971 bytes
- `text.txt` 7ef4fbb68cf300de902a7ae7193b4d2e5ce539e4b21c4040a0e6fcabf7e02e2f 4,716 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/qnap-statement-php2shell/index.html