Synology NAS Ransomware: Update Outdated DSM Now

Synology says attackers are exploiting a DSM flaw patched in December 2024 to encrypt outdated NAS devices. HKCERT has issued an alert. Here is what to check.

Synology says attackers are exploiting a DiskStation Manager (DSM) vulnerability that it patched in December 2024 to encrypt data on NAS devices running outdated or end-of-life DSM versions and demand a ransom. HKCERT issued a ransomware alert about the attacks on 2 November 2026. If your office keeps shared files, accounting records or backups on a Synology NAS, check its DSM version today.

What happened

On 29 October 2026 Synology said it had identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated DSM versions, with the aim of encrypting data and extorting a ransom. A second Synology statement the same day says the threat targets end-of-life DSM versions and was found during its impact investigation into the PHP2Shell vulnerabilities. Synology urges everyone on a vulnerable version to update DSM immediately and to turn on automatic updates.

Synology has not said which CVE is being exploited. It points users to advisory Synology-SA-24:20, which covers three DSM flaws from the Pwn2Own 2024 contest: CVE-2024-10441 (remote code execution, CVSS 3.1 9.8), CVE-2024-50629 (limited file read, 5.3) and CVE-2024-10445 (limited file write, 4.3). Which of these, if any single one, is used in the current attacks is unconfirmed. As of the CISA Known Exploited Vulnerabilities catalog version released on 30 October 2026, none of the three was listed.

Synology-SA-24:20 lists the builds below. Treat them as minimum baselines only, because a later Synology advisory raises the bar (see the next section):

DSM 7.2.2: 7.2.2-72806-1 or above
DSM 7.2.1: 7.2.1-69057-6 or above
DSM 7.2: 7.2-64570-4 or above
DSM 7.1: 7.1.1-42962-7 or above
DSM 6.2: 6.2.4-25556-8 or above

BleepingComputer reports that the ransomware is known as C3RB3R (Cerber), that encrypted files get a .L0CK3D extension and that victims find a ransom note named read-me3.txt. It also cites Shadowserver as tracking more than 380,000 Synology NAS devices exposed to the internet. Synology has not published indicators of compromise or a decryptor, and these details have not been confirmed by Synology.

Newer critical DSM flaws: Synology-SA-26:13

On 18 September 2026 Synology published Synology-SA-26:13, rated Critical. It includes two flaws scored CVSS 9.8, CVE-2026-13684 (in SCGI) and CVE-2026-13639 (insufficient entropy in the login logic), that let remote attackers read or write arbitrary files and cause a denial of service without logging in. The fixed builds are:

DSM 7.4: 7.4-90075 or above
DSM 7.3: 7.3.2-86009-4 or above
DSM 7.2.2: 7.2.2-72806-9 or above
DSM 7.2.1: 7.2.1-69057-12 or above

Third parties link the current campaign to these newer flaws. The CUHK Information Technology Services Centre says the attackers reportedly exploit CVE-2026-13639 and CVE-2026-13684, and The Hacker News reports that an analysis by Qihoo 360 connects C3RB3R to the same two CVEs. Synology itself has so far cited only the December 2024 fix. Either way, a NAS on an older SA-24:20 build such as 7.2.2-72806-1 is not protected against the SA-26:13 flaws. SA-26:13 does not list fixed builds for the end-of-life DSM 7.2, 7.1 or 6.2 branches.

A separate PHP2Shell update for NAS packages

Synology has also released PHP security updates for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on DSM 7.4 and 7.3 and on the end-of-life DSM 7.2, 7.1, 7.0 and 6.2. Only devices running certain PHP-dependent packages are affected: Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress. Synology Drive is not affected. HKCERT notes that Synology has not confirmed whether PHP2Shell was involved in the ransomware attacks.

Why it matters to Hong Kong SMEs

Many small offices in Hong Kong bought a Synology NAS years ago as a file server or backup box and have not touched it since. Older models can be stuck on DSM releases that no longer receive regular updates, and remote access is sometimes opened through router port forwarding so that staff can reach files from home. If the NAS is also the only place backups live, one compromised device can take out both the working files and the copies you would restore from. Our guide to what ransomware is explains how these attacks usually unfold.

What to do now

Check the DSM version. In DSM, open Control Panel and the Update & Restore section. Update to the latest DSM build your model supports. On DSM 7.2.1 to 7.4, that means at least the Synology-SA-26:13 builds above; the SA-24:20 builds are only an older baseline.
Turn on automatic updates for DSM once you are up to date, as Synology recommends, and update packages in Package Center.
Update PHP and affected packages. If you use Web Station, WordPress, MailStation or the other packages listed above, install the PHP update in Package Center. MailStation needs a separate manual update. On DSM versions earlier than 6.2, disable these packages until you move to a supported DSM version.
Plan replacement of end-of-life hardware. If a model cannot run a supported DSM version, budget to replace it rather than relying on one-off fixes. Our patch management guide explains how to keep track of devices like this.
Take the admin interface off the internet. Do not expose DSM management ports directly. Remove unneeded port forwarding, use a VPN for remote administration, and turn on multi-factor authentication for admin accounts.
Keep a backup the NAS cannot overwrite. HKCERT recommends offline or immutable backups and regular restore tests. A second share on the same NAS is not enough.

If files are already encrypted

HKCERT advises isolating the NAS from the network and pausing sync and backup jobs, preserving ransom notes, sample files and logs, and avoiding a reset or format. Bring in IT support or an incident response provider, clean and patch the system, reset credentials from a clean device, then restore from verified clean backups. Paying does not guarantee recovery, and installing updates will not decrypt files that are already encrypted. Incidents can be reported to HKCERT online or through its 24-hour hotline, +852 8105 6060.

Our cybersecurity and compliance team can review NAS exposure and backup design, and managed support can take over routine DSM and package updates.

Frequently asked questions

Is this the same as PHP2Shell?

No. Synology links the ransomware to a DSM flaw patched in December 2024. PHP2Shell is a separate set of PHP flaws, and Synology has not confirmed a connection. Apply both sets of updates.

Our NAS is not reachable from the internet. Are we safe?

Your risk is lower, but you should still update. Synology has not published the full attack path, and a device on the office network can still be reached from an infected PC.

Does Synology Drive need the PHP update?

Synology says Synology Drive is not affected by PHP2Shell. DSM itself still needs updating: at least 7.4-90075, 7.3.2-86009-4, 7.2.2-72806-9 or 7.2.1-69057-12 (Synology-SA-26:13), and preferably the latest build for your model.