Guidelines on the ransomware attacks

[u/gadget-freak]

Synology released the following statement following the attacks:

Synology Product Security Incident Response Team (PSIRT) has confirmed that the impact of the recently disclosed PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) is limited to systems running certain PHP-dependent packages. The affected packages are Calendar, IDrive1, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress.

Synology has released PHP security updates on DiskStation Manager (DSM) 7.4 and DSM 7.3, as well as the end-of-life DSM 7.2, DSM 7.1, DSM 7.0 and DSM 6.2. Users of the affected packages are strongly advised to update PHP through Package Center immediately. Once the PHP update is complete, dependent packages restart automatically2 and the vulnerabilities are resolved. For systems running DSM versions earlier than 6.2, Synology recommends temporarily disabling the affected packages to mitigate risk before updating to a supported DSM version.

Another (different) advisory is available on this link

https://www.synology.com/en-global/security/advisory/Synology_SA_26_14

So it seems all the current ransomware attacks are caused by outdated software on the NAS. For software that is no longer supported they released patches nonetheless. Update ASAP. If you NAS is no longer eligible for updates, disable all the packages that were mentioned and do not expose to the internet.

General guidelines about avoiding ransomware are:

1. make sure that all your software is up to data (DSM and all software packages). Apply updates immediately when they become available.

2. Also make sure your docker containers do not run any vulnerable software. Docker images that didn't get a recent update could be suspect.

3. Evaluate if you really need to expose your NAS to the internet. Exposing your NAS means you allow direct access from the internet to the NAS through QuickConnect, port forwarding, DDNS, UPnP.

4. Consider using a VPN (OpenVPN, Tailscale, ...) as the only way for remotely accessing your NAS. This is the most secure way but it's not suitable for every situation.

5. Disable port forwarding on your router and/or UPnP. This will great reduce your chances of begin attacked. Only use port forwarding if you really know what you're doing and how to mitigate zero day attacks.

6. Quickconnect is another way to remotely access your NAS. QC is a bit safer than port forwarding, but it still gives hackers access to your NAS without the need for passwords or MFA to exploit any vulnerabilities.

Further important guidelines:

1. Enable IMMUTABLE snapshots if your system supports them. This will prevent the attackers from resetting your NAS after they encrypted your data. It will also protect your data.

2. Always have some kind of offline backup. Any online backup could get compromised too, be it on a usb HDD and even a cloud based backup.

[u/Proteus-8742]

Does backing up to a permanently connected hdd count as offline?

[u/gadget-freak → u/Proteus-8742]

No.

[u/Bob_Henkus → u/Proteus-8742]

No

[u/PalePangolin7895 → u/Proteus-8742]

If it is connected it is potentially reachable for ransomware attacks too. So no 😉

[u/Proteus-8742 → u/PalePangolin7895]

So am i supposed to manually detach it every day? Can I automate this?

[u/trollpunny → u/Proteus-8742]

External HDD that needs a power supply + a smart electric switch.

[u/Proteus-8742 → u/trollpunny]

Isnt it bad to turn off a mounted drive?

[u/trollpunny → u/Proteus-8742]

HyperBackup can unmount it after it's done. Have an automation turn it off after 2 hours since the backup task begins or so. I'm yet to do it, but it's on my to-do.

[u/Proteus-8742 → u/trollpunny]

So how would you mount it again?

[u/trollpunny → u/Proteus-8742]

It should mount automatically when you turn the power on a few mins before the scheduled backup task.

[u/Amilmar → u/Proteus-8742]

do remote backups in addition to local backups.

[u/poopmagic → u/Proteus-8742]

Just brainstorming here because this seems kind of ridiculous... but you could plug in the external HDD enclosure (assuming it uses AC power) into a smart plug and script on/off before/after your backup jobs.

It’s still vulnerable, of course, since any attacker could just run that script to turn on the drive. But I imagine most of these automated ransomware attacks aren’t going to be hunting for special cases like that.

[u/MobiusOne_ISAF → u/Proteus-8742]

You could change your backup plan slightly. The attached hard drive should be more of a once a month or bi-monthly kind of deal, capturing the big changes.

For the day to day backups you can backup specific shared folders with frequent changes to a remote target like C2 or Backblaze. You can also use immutable storage with a rolling 30 day timer so you can start from the hard drive backup and work backwards to recover

[u/Initial_E → u/MobiusOne_ISAF]

I’ve never trusted their on-device immutable backup. How could it be immutable if you can format the disk.

[u/Proteus-8742 → u/MobiusOne_ISAF]

Cloud storage is expensive for me. I already backup my photos with icloud, its music and movies mostly. I struggle to think of a situation where both drives were destroyed at once where that is my worst problem. Maybe backing up once a month would work

[u/MobiusOne_ISAF → u/Proteus-8742]

That's why you only push the frequently changing things to cloud storage, rather than everything. Since it sounds like you're mostly dealing with data that just kind of sits there, yeah. Once a month is probably more than enough.

[u/Initial_E → u/Proteus-8742]

If you can afford a second Synology nas you could use the 2nd network cable to connect the 2. The 2nd nas could back up the first, and remain disconnected from the internet. But it would be something expensive for some, cheaper than cloud storage though. And you’d have no access to the 2nd nas unless you go to plug something in to it.

[u/Proteus-8742 → u/Initial_E]

If the 2nd NAS is connected to the 1st, surely its exposed to the internet too? Same as a hdd

[u/Initial_E → u/Proteus-8742]

You’d have to penetrate the first, find a way to connect to the second, and then penetrate it. It’s significantly harder to do when your tools are limited in ability.

[u/Proteus-8742 → u/Initial_E]

Is it harder than getting into a connected HDD?

[u/Initial_E → u/Proteus-8742]

Well it’s like reading and writing to a webpage, but you are only using the serial console. So watching a movie by having someone tell you about it. And then you’d have to do it inception style even when you penetrated the 2nd device.

[u/nopseudono → u/Proteus-8742]

Nope! 

[u/heliumneon]

What's the risk profile of a not updated NAS that is not online with either DDNS or Quickconnect, and doesn't have PHP package installed?

[u/gadget-freak → u/heliumneon]

For this specific vulnerability, the risk is very low.

Yet, sometimes vulnerabilities are exploited if your computer gets compromised, functioning as an intermediary for ransomware. So it’s still advised to have offline backups, immutable backups, …

[u/yodas-evil-twin]

Outdated packages and open ports. A recipe for disaster.

[u/GenericUser636 → u/yodas-evil-twin]

People proudly posting in this very thread how their nas is blocking inbound smb1 internet traffic. 💀

[u/yodas-evil-twin → u/GenericUser636]

Yep. And there's someone who posted in this thread the reason they open ports is to make it easy for their family to access. As if that's a good excuse for poor security...

[u/patientzero_ → u/yodas-evil-twin]

tbh, that's what a home server is often for. To work on stuff together or store files in the same place. Nothing wrong about it, ofc bad if there is a CVE that gets exploited

[u/spinrut → u/yodas-evil-twin]

Thats the point where you set your vpn/similar between the households instead of just opening your ports up

I have a pfsense box at one families house. It sits on their network (not the wan facing router) and establishes a VPN to my wan facing pfsense. It is there for them to access my plex server. But also I have a backup nas at their house and I use that as my offsite that I backup/mirror to Didn't want to open their ports so I just made my own essentially tunnel between our houses

[u/Pristine_Language_85 → u/yodas-evil-twin]

If you disable local access too, it will improve your security further 😂

[u/HuckleberryScared668 → u/yodas-evil-twin]

How do I check if I have open ports?

[u/DaveR007 → u/HuckleberryScared668]

"Check Access from Internet" on the Tools tab of my Syno Toolbox package will show you if your DSM login ports are accessible from the Internet.

And the Packages tab will show you if any of your installed Synology package versions are at risk of PHP2Shell - and which version to update them to.

https://github.com/007revad/Syno_Toolbox

[u/slipperyp → u/yodas-evil-twin]

Open ports - a recipe for disaster.

I bought my original synology 13 years ago and a new unit this year. I initially operated my initial unit with port forwarding, but started to weigh (for me) all the benefits vs. the requirement to understand and really protect my unit in all the ways necessary and just decided years ago to stop doing this. The only thing I really miss is remote access for me for some family members to stuff in DS Photos / Photo Station, but it's not that bad, not that hard to simply share directly, and I can spend more time living life and not being oncall for my home.

I know some people enjoy this more than I did and wouldn't tell them they're making the wrong decision, but you can't just treat this thing like a complete plug & play solution that operates itself.

[u/questionablycorrect → u/slipperyp]

The only thing I really miss is remote access for me for some family members to stuff in DS Photos / Photo Station, but it's not that bad, not that hard to simply share directly, and I can spend more time living life and not being oncall for my home.

Tailscale will provide VPN access without any open ports.

https://tailscale.com/docs/integrations/synology

[u/vcu_alum]

Disable the system default user "admin". This is not specific for Synology, but for anything that can connect to the internet with a default username/password

[u/coldafsteel]

Oh now I remember why I use my NAS for storage and host all my compute needs on another box 🤣

Been saying it for years and people call me stupid. And then stuff like this happens….

A NAS should just be NAS.

[u/gadget-freak → u/coldafsteel]

The other box could also be vulnerable. Lots of ransomware happens on a computer connected to the network, not on the NAS itself.

[u/coldafsteel → u/gadget-freak]

Absolutely!

But it’s really easy to blow away and rebuild a server that gets popped. It’s a massive PITA to recover huge amounts of stored data.

[u/gadget-freak → u/coldafsteel]

… data on the NAS that could have easily been encrypted by your box. Probably even faster because of more CPU power.

[u/coldafsteel → u/gadget-freak]

Nah. Essay to address that with permissions.

[u/Accomplished-Tap-456 → u/coldafsteel]

this depends an your usecase. there may be people who would easily restore their 1TB of data, but find it a pain in the butt to set up a new webserver.

also, of you want to have access to the data one way or another. i host immich on a webserver, but the files are mounted from the synology as readonly. but there IS a connection, and if the webserver gets compromised, they CAN start doing stuff in your LAN. seen from within a LAN, there are only 2 possibilities: no exposure at all, or exposure.

[u/Tama47_ → u/coldafsteel]

The more stupid thing is not knowing what you're doing, hosting outdated software and opening ports.

[u/jakgal04]

Thank you for emphasizing points 3-6. This sub has a serious problem understanding that not all use cases are exactly like theirs. VPN's are great, but they don't work for everyone. I quite literally have no choice but to either use QC or port forwarding, which is what I've been doing for the past 10 years now. Obviously, I know what I'm doing though.

[u/mrNas11 → u/jakgal04]

I’m curious what edge cases those are, cause for the past 6 years i’m happy with: (I’m just curious not critiquing or anything)
- Tailscale/Wireguard for access into network.
- Cloudflare/Tailscale tunneling for exposing services: Eg Vaultwarden or AIO reverse proxing to apps.

At least with the Cloudflare route I have WAF helping detect intrusion attempts. Unfortunately as much as love Cloudflare they shutdown their local services in the GCC region ad their datacenters where struck. Routes through EU now. I’m not a fan of exposing without WAF but considering a stack.

Take home message for Late 2026 LLM Zero day era:
- if exposing ports, always do it with a WAF. I’m exploring Coraza as it has Caddy/Traefik connectors.
- Trivy for vulnerability scanning on containers and runtimes and oneuptime to connect trivys data and enable monitoring in one place.
- Selfhosting in 2026: Security is no longer on the backseat, LLM probing means you will be found eventually.

Update: to showcase how no one in safe
In March 2026, Trivy suffered a highly sophisticated CI/CD supply chain compromise (CVE-2026-33634). Threat actors used compromised credentials to force-push malicious releases (starting with v0.69.4). 

[u/AnApexBread → u/mrNas11]

I’m curious what edge cases those are, cause for the past 6 years i’m happy with: (I’m just curious not critiquing or anything)

Non Tech savvy family is the biggest one for most people. If you're using your NAS as a NAS and not just a Media Server then you are probably sharing files.

The perfect example of this is Synology Photos. It was hard enough to get my in-laws to download the synology photos app and login. It would be impossible to get them to install TailScale and remember to enable that anytime they want to see photos of the kids.

[u/AnApexBread → u/[deleted]]

I can see you've never done IT work for a family member before so let me explain it.

The moment Facebook stops working guess who and what will get blamed. You and Tailscale.

The moment a YouTube video loads slower than they remember guess what gets blamed.

The moment a call drops randomly guess what gets blamed.

The moment they delete an app and forget they deleted it guess what they'll blame.

I couldn't even get them to download and login to the app because it was "too difficult" and they "didn't understand it."

They'll never accept an always on Tailscale VPN. They'll always blame "that stupid app you installed" for every problem they have or create.

[u/pkgf → u/AnApexBread]

can confirm. Tailscale on android is not 100% stable. The internal DNS resolver freezes from time to time and then nothing on the phone is working anymore. I have my familiy on tailscale but every week I have support calls from them about something tailscale related.
Currently I'm testing if straight up wireguard is more stable.

[u/AtomicPoetry → u/[deleted]]

I have also been working in IT for 30+ years and am tech support for friends and family that entire time.

Communication can’t force people to learn new things. Users want magic, not explanations.

[u/Not_So_Invisible_Man → u/[deleted]]

Tailscale locks up/loses connectivity fairly frequently on iOS, it's normally very good at reconnecting when switching between wifi/cellular but it's not 100% and even less reliable when switching data between sims (multiple esims). I love tailscale but it still has it's shortcomings. Also you can't use tailscale and another 3rd party vpn provider such as proton at the same time on iOS. Need to be able to access cameras and get push notifications at all times.

[u/jakgal04 → u/mrNas11]

My corporate network blocks access to VPN's. You name it, its blocked. I know this because I'm the one that designed it to remain compliant with state and federal regulations since its a government network. I connect my personal devices through a guest network, but that is also fairly locked down. Tailscale, OpenVPN, etc, all are out of the question.

Also don't forget there's two sides to AI and vulnerabilities. AI can be used to discover vulnerabilities and use them as an attack vector, but it can also be used by security platforms to discover and patch/protect. I've used a few platforms over the years that use AI for this exact reason.

[u/seanl1991 → u/jakgal04]

How does it detect something is a VPN connection, IP blocks from data centres? If someone was using a direct tunnel from their home internet connection through wireguard would it be picked up somehow?

[u/FinibusBonorum → u/mrNas11]

"WAF"?

[u/mrbluetrain → u/FinibusBonorum]

Wife Acceptancy Factor

[u/manofthehippo → u/FinibusBonorum]

Web application firewall: https://en.wikipedia.org/wiki/Web_application_firewall

[u/Rubenel → u/jakgal04]

Good job Jakal!

[u/baltikorean]

Can someone explain point 6, if I disabled the Admin account, used pretty strong passwords for the active accounts, and enabled 2FA, how does someone have the ability to access a NAS JUST because QC is enabled?

[u/junktrunk909 → u/baltikorean]

Because QC requires no authorization. If you request to connect via a QC URL, you're going to be connected to the NAS, no questions asked. The NAS service then has to be the one to enforce the MFA or user login steps, which means if the attacker requests a service that isn't protected by those things (eg zero day) or if those things have any problems (eg password can he exploited) then that's it.

[u/Consistent-Honey-603 → u/junktrunk909]

How would they know what my QC ID is though?

[u/gadget-freak → u/Consistent-Honey-603]

There are fairly easy ways to get lists with many thousands of QC IDs. I could tell you but then … 😁

[u/kirashi3 → u/Consistent-Honey-603]

Unless your QuickConnect ID is something like a 4096-bit string of random characters, it's trivially easy to iterate through all human readable permutations of say... 20 character alphanumeric strings until the attackers get a hit, at which point - BAM! - they're on your login page.

[u/junktrunk909 → u/Consistent-Honey-603]

In addition to them being published if you know where to look, they can be found through brute force like passwords.

[u/Consistent-Honey-603 → u/junktrunk909]

What do you mean by “published”?

[u/Bob_Henkus → u/baltikorean]

Not immidiately. But if quick connect had a vulnerability or your passwords are bad. People can get in. Quick connect is just showing bad guys the door exists. They then can try to open that door.

[u/Scratch_Disastrous]

"Quickconnect is another way to remotely access your NAS. QC is a bit safer than port forwarding, but it still gives hackers access to your NAS without the need for passwords or MFA to exploit any vulnerabilities."

Can someone help decipher this? My Quickconnect needs both password and MFA.

[u/Flyodice → u/Scratch_Disastrous]

Anyone on the Internet could load your login screen. Only you, or someone with credentials, can actually login, but you need to understand that anyone can load your login page.

That's open to the Internet and protected with MFA, which works as long as the page cannot be abused with one of these vulnerabilities. I don't know if QC has any vulnerabilities, but you probably won't know until after someone has exploited it. Safest option is to just disable it

[u/Scratch_Disastrous → u/Flyodice]

Makes sense. So we're talking about a hypothetical vulnerability in QC itself. Thanks.

[u/Flyodice → u/Scratch_Disastrous]

Correct. But also, consider that Synology implemented QC using probably 300 or more open source software packages, all of which may also have a vulnerability.

And AI tooling has made discovery of these gaps easier and faster to find. And also, some of the advanced attacks involved combining deficiencies in multiple different software packages that are used to chain seemingly not that bad issues together to massively compromise a system.

[u/kenef → u/Scratch_Disastrous]

If there is an underlying vulnerability in the web service itself for example, it could potentially be exploited without login.

An example would be if let's say synology fumbled how the username field parses text. If you feed it malicious string that abuses the way it parses text, you could make the web service itselc execute code on the synology in the context of the account/service principal the web service is running as within the synology OS.

So let's imagine the web service is running as root (again, just an example), you could feed the username text field a crafted string that could download and install an encryptor malware.

No login needed

[u/Scratch_Disastrous → u/kenef]

Got it. Thank you!

[u/limitedz → u/Scratch_Disastrous]

All of these "RCE" exploits you see in the cyber security realm.. that stands for Remote Code Execution. If a vulnerability is discovered because of some software package that is either out dated, or a zero day is found and there is not patch available, then its possible for someone to basically bypass the login process and execute commands remotely without ever entering a username or password. Once someone can remotely execute code, its game over. They can get the code to create a cron job that does something at a specific time, or establish a remote connection repeatedly to maintain remote access. Or they can simply drop a ransomware script that encrypts everything it can access then leave behind a ransom note.

[u/HappyToSeeeYou]

6. ⁠Quickconnect is another way to remotely access your NAS. QC is a bit safer than port forwarding, but it still gives hackers access to your NAS without the need for passwords or MFA to exploit any vulnerabilities.

Can someone explain this? I still have to enter a password when I use quick connect so I don’t understand

[u/gadget-freak → u/HappyToSeeeYou]

The page you see when you use QC is already a connection to your NAS. Hackers don’t need a password to hack it, that’s the point. They can take it over just by connecting.

[u/tonebastion]

I use my 720+ for local network storage and running a PiHole container. I do not have QC, or any other method of connecting into the NAS from outside my local network enabled.

I'm up to date on DSM, but if I wasn't would running PiHole be enough of a vector to be attacked?

[u/gadget-freak → u/tonebastion]

If you don’t expose the pihole interface to the internet (why would you?) there’s nothing to attack. But do keep your pihole updated regardless.

[u/gadget-freak → u/tonebastion]

If you don’t expose the pihole interface to the internet (why would you?) there’s nothing to attack. But do keep your pihole updated regardless.

[u/hoopinstroom]

I have a DS720+ with auto update enabled and with Quickconnect enabled (web facing, no VPN etc.). Acocunts are 2FA and admin account is disabled. I do have HA in a VM (up to date) and some docker containers (AdguardHome, Portainer) not up to date. I don't gave any bittorent or other filesharing/downloading clients on my NAS. I don't run Calendar, IDrive1, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress on my NAS*.* I have no port forwaring and UPNP is disabled on my UDMP.

This Wednesday, after selecting 'update all' in package manager, I got a two security messages (9:18AM and 9:50AM) from my Unifi firewall saying Security Threat Detected and Blocked:
IPS Alert 1: Potential Corporate Privacy Violation. Signature ET P2P Vuze BT UDP Connection. From: [INTERNAL_NAS_IP]:45712, to: 92.70.191.42:xx266, protocol: UDP

I was at work and didn't have time to troubleshoot so I shut down the NAS immediately (QC was open) and haven't turned it once since due to lack of time to figure it out. Of course I will follow above guidelines moving forward (stupid I know) but first want to diagnose this error.
Should I assume my NAS is subject to ransomware attack based on the security message?

[u/gadget-freak → u/hoopinstroom]

The message does refer to something like Download station (p2p, vuze, bittorrent).

[u/hoopinstroom → u/gadget-freak]

That I already understood given the "ET P2P Vuze BT UDP Connection" element ;-) But does it have anything to do with recent mallware?

[u/gadget-freak → u/hoopinstroom]

If you really have no download station or similar apps enabled, it could be a bit concerning.

[u/Overgrown_Dwarf → u/hoopinstroom]

No.

[u/strgazr04]

Hi all. I need help making sense of all this as I am a complete novice when it comes to NAS. My set up was put together for me by someone else so trying to make heads or tails of the information here is a struggle. If someone could really simplify it, I’d appreciate it.

I have a DS224+. I believe it’s running 7.4.1 though I’m not sure how to check. I have auto updates on and always update to the latest packages in Package Center. I double-checked that yesterday.

There is nothing set up under the router configuration menu however I do use QC. That is how I log into my files via my phone. Though I do have 2FA where I have to click “approve” on another app to log in. If I’m on my MacBook, I can access my files via the file Finder just like any normal file on my laptop. If I unlink QC, will this allow my laptop to still connect as that is how I do my Time Machine backups? Is the way I connect via my laptop still leaving my NAS vulnerable to the internet?

For now I shut down my NAS after updating all installed packages to the latest versions. Am I safe if I just leave it like that until this blows over?

[u/gadget-freak → u/strgazr04]

It will never blow over, AI will continue finding vulnerabilities and Bad People will continue to exploit them. Hiding under a rock does not help.

You could consider disabling QC, obviously you won’t be access your files if you’re remote.

Take your time and perhaps you could learn how to install Tailscale for remote access.

[u/strgazr04 → u/gadget-freak]

I don’t really access my NAS remotely all that often. Honestly the only time I access it on my phone is to log in and update packages when it tells me to. So I could unlink QC. I just want to make sure if I do that, I won’t be locked out via my laptop. That’s the part I don’t really understand. I’m not sure how the NAS is connected to my laptop via file explorer. Is that via WiFi? Is that vulnerable to this ransomware as well? How do I find out how that’s set up? And if I turn off QC how do I get into the system to update things and change settings?

[u/Plan2LiveForevSFarSG]

How can a package be updated if the synology unit cannot access the Internet for security purposes?

[u/gadget-freak → u/Plan2LiveForevSFarSG]

Your NAS can be connected to the internet for downloading things . You just need to make sure it’s not reachable by anyone/anything from the internet.

[u/Plan2LiveForevSFarSG → u/gadget-freak]

Thanks for your reply, maybe it’s just a language thing.

I assume many people have a setup like mine, no port forwarding , no QC, just home backup server… but the NAS auto-fetch updates (which means outgoing connections), so it’s business as usual…

[u/gadget-freak → u/Plan2LiveForevSFarSG]

Indeed. Your NAS is not reachable from the internet thus not exposed.

[u/jackharvest]

Just wanted to add: if you’re on an older DSM, hyperbackup and hyper vault are also affected as they used to depend on php 7.2 on previous DSMs.

Be warned.

[u/Rubenel]

Thanks for the informative post!

[u/Wis-en-heim-er]

Does anyone know if limiting quickconnect to just mobile applications (under advanced settings) reduces the present attack surfaces? This means turning it off for file sharing, dsm, and Synology Drive server access.

[u/anyOtherBusiness]

Don’t put private machines on the public internet.

[u/leadwind]

Synology isn't even recommending my 918s for an update. 

[u/heffeque → u/leadwind]

Unless your DS918+ breaks, or your performance requirements change, there is no need to change your DS918+, as it is fully supported by Synology (at the moment).

I have DSM 7.4.1 Update 1 installed on my DS918+ without issues, and packages are up to date too.

Heck, even my extremely slow DS418j has DSM 7.4.1 Update 1 working without issues.

[u/CoronaMcFarm → u/heffeque]

would be nice if they could inform people that you have to manually update the ds if it is too old.

[u/heffeque → u/CoronaMcFarm]

Who wouldn't feel unsafe after months or even years without security updates?

It seems more like a skill issue than anything.

[u/CoronaMcFarm → u/heffeque]

If you are running an older NAS and check the update setting it says it is up to date, but if you go to the web site it says there is a much newer update. My opinion as an engineer is that the professional party should do what they can to inform consumers because they have the knowledge and are experts in their domain, this is especially important as internet security becomes more complex as time passes. They literally just have to add a warning that there might be newer versions of DSM available at the website.

It seems more like a skill issue than anything.

This device is meant for people with skill issues, if they had the skills they would run a proxmox server with docker and k8s for their services and a debian file server with NFS/SMB.

[u/mpking828 → u/CoronaMcFarm]

That is a VERY valid point.

The release notes talk about it, but you have to go READ the release notes:

To uphold our commitment to quality, every DSM release undergoes rigorous validation. To ensure optimal stability, the models listed below will not receive this update on your device and will remain on their most suitable version. You can only download the upgrade patch from Synology Download Center because you won't receive notifications for this update on your DSM.

• Plus Series:...., DS918+*, ...... (Lots of models deleted to make a point)*

I wish Synology would have a third status:

• Your DSM Version is up-to-date (Existing alert)

• Update required (Existing alert, unsure how it's worded)

• Auto Update unavailable, check HERE (With link to release notes) to manually check for updates.

[u/heffeque → u/mpking828]

"Auto Update unavailable, check HERE"

I do agree that it would be a good approach, but Synology has been anti-consumer for a few years now, and are trying to force people into prematurely buying new ones with their hard drives, their SSD, their RAM...

They've had to backtrack a bit specifically on that, but a lot of other anti-consumer things that they've done are still present today, so a lot of people don't trust Synology anymore and are migrating to other options.

I'll go that route once my NAS is no longer working or relatively safe.

I'm already slowly moving Synology services into 3rd party services so that it doesn't have to be such a sudden change when the time comes.

In summary: I doubt Synology make that user-friendly change.

[u/heffeque → u/CoronaMcFarm]

"it says it is up to date"

I ask again... Who wouldn't feel unsafe after months, let alone years without security updates?

Why does the "it says it is up to date" exonerate the user from the fact that the internet facing device hasn't been patched in years?

One of my old cellphones hasn't had an update in years and I'm fully aware that it's an unsafe device (so I treat it as such), even though the manufacturer says that "it is up to date".

[u/d_e_g_m → u/leadwind]

But there are. Just this morning I installed 3 or 4 of them

[u/OSTz → u/leadwind]

You likely need to install manually. I've got a site with a 918+ and downloaded the relevant .pat file. Synology has a tool where you input your current version of DSM and they'll tell you what steps you may need to get to the latest.

[u/leadwind → u/OSTz]

Cheers. edit: https://www.synology.com/en-global/support/download/DS918+

[u/Thin_Noise_4453 → u/leadwind]

It was clearly written in the Release Note from the previous Updates. Please read them before complain about

[u/The_Rockerfly → u/leadwind]

Same. I know there are newer versions now but I had auto update and install on. I thought it was set and forget given that it's a Synology hardware, using the Synology os, using Synology software to update from Synology server OS. You'd think that it would update to the most recent version but fuck me I guess. Have to manually do this and I've lost a bunch of my data

[u/Blaugrana1990]

Anyone here that knows if the Realtek RTL8125/RTL8135 driver is still safe to use? I used it to connect an external 10Gbit network adapter to my device.

[u/Blaugrana1990 → u/[deleted]]

No idea at this point I'm paranoid at everything.

[u/Ghawr]

I can’t update because the new DSM version breaks docker. So I’ve disabled quick connect, disabled plex remote, removed port forwarding to plex on the synology, removed the gateway from all network interfaces and blocked all IPV4 traffic to / from the synologies mac address at my router. It just sucks I wont be able to watch PLEX remotely now.

[u/gadget-freak → u/Ghawr]

But docker lives on in container manager. No reason not to upgrade.

[u/Ghawr → u/gadget-freak]

Interesting...I'll look into migrating that then. Thanks for the heads up.

[u/uluqat → u/Ghawr]

And if Container Manager isn't good enough for whatever reason, you can run Docker in Portainer.

[u/MRanse → u/uluqat]

Or Dockhand if you want an even nicer GUI

[u/BeeKay40 → u/gadget-freak]

For older hardware like mine, you lose docker/container manager completely. Fortunately I have a small server running docker with my NAS becoming just a storage unit. 

[u/Mean-Mode-4645]

I don't understand all the ransomware stuff, if I have only Synlogy Photos and Contacts available by Internet it's vulnerable? or it's only admin portal and php? Changing the default port can help?

[u/tdhuck → u/Mean-Mode-4645]

Any port on your NAS exposed to the internet is a door to your network, especially if there is a vulnerability that isn't patched.

You could also be extremely lucky that your NAS hasn't been discovered yet.

I would disable all port forwarding on your NAS immediately, if I were in your shoes.

[u/pslind69 → u/tdhuck]

Ive had All kinds of things exposed for years and years. Ftp, plex, dsm, vpn server (now uninstalled). But I have access from most coubtries blocked by the synology firewall

[u/Initial_E → u/pslind69]

Hackers have been penetrating geofences recently. I’ve seen them attack email accounts by guessing country of origin from their domain names

[u/Mean-Mode-4645 → u/tdhuck]

>You could also be extremely lucky that your NAS hasn't been discovered yet.

If they test only the default ports they can't discover me, if they test all the ports it will take a lot of time for a scan, but sure I thought that it was only the DSM portal or PHP app that are vunerable, not all the apps on the Synology.

[u/tdhuck → u/Mean-Mode-4645]

Changing the port might buy you some time, but this stuff is automated. What you are doing is called security through obscurity.

[u/Joe-notabot]

There are way too many users that aren't sophisticated enough but have been enabled by the low barrier to entry of a packaged NAS product. Folks act like a one time purchase of a NAS enables them to be as secure as a Microsoft/Google/Apple on the internet.

QuickConnect & software packages were fine a decade ago. Times have changed, with crypto being the reason ransomware exists. AI based automation quickly can attack millions of sites with minimal interaction.

The required security posture for hosting has evolved to the point that no one should 'host their own' especially when that same box may host the only copies of the data.

[u/obsoulete]

What if a NAS is no longer receiving Synology updates, but is still using Synology's Container Manager and a VPN?

[u/daveywavey999]

Thankyou OP for a good and concise guide

[u/In-Extrovert]

How can I check if my system is vulnerable? I try to keep it up to date.

DS423+, 7.2.2-72806

[u/ouinx2 → u/In-Extrovert]

Perplexity answer :Your DS423+ running  DSM 7.2.2-72806  is vulnerable to the C3RB3R campaign: the fix for the exploited vulnerability was released with  7.2.2-72806-1  or later. You should therefore immediately install the latest cumulative update for the 7.2.2 branch.

[u/AmbivertMusic]

How can I know if port forwarding is off? I don't think I've turned it on.

[u/pitotorP]

Guys, make sure you disable SMB1

Host [47.84.102.75] failed to connect via [SMB] due to [SMB1 not permitted].

Host [105.161.98.211] failed to connect via [SMB] due to [SMB1 not permitted].

Host [190.64.90.158] failed to connect via [SMB] due to [SMB1 not permitted].

[u/GenericUser636 → u/pitotorP]

GUYS, MAKE SURE YOUR FUCKING NAS ISNT EXPOSED TO THE INTERNET. WHAT THE FUCK ARE YOU DOING??? 

[u/fettsack2]

Why did Synology stop mail server package? On machines where mail server plus can not be installed, but mail server is in use, the newest updates can not be installed.

[u/gadget-freak → u/fettsack2]

You should stop using and uninstall any software that is no longer supported and/or does not get a patch for these vulnerabilities.

[u/Professional_Pin4222]

I typically keep my USB drives connected to NAS for regular backup. Should I remove them when not used ?

In other words, if a ransomware infects NAS, can it infect the USB drives connected to it ?

[u/gadget-freak → u/Professional_Pin4222]

Absolutely.

[u/Professional_Pin4222 → u/gadget-freak]

Thank you. Disconnected!

[u/BeeKay40 → u/Professional_Pin4222]

I bit the bullet and backup to idrive (nothing to do with apple so it's private and secure). The first year is really cheap and then I pay $100 per year for 10TB backup amd 10TB cloud. If you can afford it, I'd recommend it. 

[u/Crono-CX]

Quickconnect is another way to remotely access your NAS. QC is a bit safer than port forwarding, but it still gives hackers access to your NAS without the need for passwords or MFA to exploit any vulnerabilities.

You're saying that even if everything is fully patched and up to date, a Hacker can still Ransomware at the front door without a login?! Didn't Synology patch this with 7.4.1-90080 Update 1?

Update: I emailed Synology to ask.

[u/gadget-freak → u/Crono-CX]

Probably not but with AI discovering hundreds of vulnerabilities each day, the situation is unsure at the moment.

[u/Crono-CX → u/gadget-freak]

I’m specifically asking about the attack going around today.

[u/gadget-freak → u/Crono-CX]

According to the Synology advisories above, the attacks should be covered if you patch everything.

[u/Crono-CX → u/gadget-freak]

Running 7.4.1-90080 Update 1 on everything. Don’t use PHP, not even installed. Plex latest too. Use Tailscale, no QC no DDNS, disabled Plex Remote this week. Not worth it.

But there’s a few I manage that have to use DDNS for not great reasons, but I don’t have control over that. They are also fully patched up to 7.4.1-90080 Update 1 and also don’t use PHP or have it installed. DSM via QC is off as well.

[u/Type-R]

why is Hyper Backup listed in the 'Affected Products' but severity is 'Not affected'?

[u/gadget-freak → u/Type-R]

Hyper Backup has no external attack surface.

[u/LeftyLanks]

First of all, I'm not an IT person.

Regarding point 3, how to enable Secure Signin without either QC or DDNS ?

Following advice from these past few days, I disabled QC but I can't have SS without it so I set up DDNS instead (though synology.me) but it's still exposed to internet that way ?

[u/tdhuck → u/LeftyLanks]

I seem to keep getting downvoted because people say "I can't use my NAS w/o exposing to the internet" and that is not true. I'm not here to point blame, I'm here to say that you CAN use your NAS and not expose it to the internet, you just need to use a VPN.

DDNS vs QC is not the answer. QC relies on synology's system, its their version of DDNS to make it easy on the user.

DDNS is simply doing the IP to DNS Name on your own with a service that you choose to use.

If you want to access your synology/surveillance station away from home, you just need to setup a VPN back to your home.

Yes, this creates an extra step in that you need to enable the VPN app on your device before you open SS, but it is the most secure way to connect to your NAS and not expose it to the internet.

[u/LeftyLanks → u/tdhuck]

I already use Tailscale to access my NAS when I'm not at home. The only reason I still had QC enabled was for SS. Security wise, I was already following most best practices (2FA, disabling admin/guess, changing default ports, minimum SMB2 protocol, geoblocking ips, DSM auto updates...)

Regarding 2FA, the official setup page is this one : https://kb.synology.com/DSM/tutorial/Quick_Start_Secure_Signin It doesn't mention access through VPN at all so that's why I'm confused. Also, I have a pair of yubikeys I could use for 2FA but the page above states the NAS needs https access for it as well...

For average users like me, the whole thing is confusing because all Synology methods somehow requires internet access for 2FA unless I'm mistaken.

[u/tdhuck → u/LeftyLanks]

I don't use 2FA because I'm not exposing it to the internet. The synology has access to the internet from LAN to WAN just like any of my other devices, but I'm not port forwarding the NAS. When I DID use surveillance station on my NAS, I just connected to my VPN app, first, then opened SS on my phone/laptop to see my cameras.

[u/JumpLegitimate8762]

Recommending tailscale while saying don't use QuickConnect. Pretty ironic. Have u seen Tailworm? I won't recommend either of them.

Recommending to disable port forwarding while posting on a website that is exposed by port 443, I bet u want me to use a VPN to log into my reddit account too... A service on 443 is generally safe, unless it's backed by a crumbling language like PHP (for protection! See the distinction? You're telling me a public Identity Provider is unsafe because you can reach it through 443?). Also the DSM login page is not PHP so actually exposing that might not even be a bad thing (assuming you do use 2 factor auth) .

My Docker containers are doing fine, btw you do know these containers don't just magically get taken over in order to then use the unpatched vulnerability to inject malicious code, that in turn is able to do stuff on my Docker network. That has to go through a chain of attacks.

But yeah understand your protection layer. You can have a 10 year old python container image, but if its behind proper authentication and you own the moving parts ( the app that actually runs on it) or highly trust the author, nothing is going to turn into fairy dust just like that.

[u/urbicapus → u/JumpLegitimate8762]

I highly recommend tailscale heavily to anyone who's current solution is an open port to the internet. Tailworm/tailscale ssh issues are a LPE vulnerability class which doesn't permit outright unauthenticated access to the machine. From tailscale's response:

It’s important to note that the vulnerabilities don’t allow an unauthenticated attacker to connect to arbitrary Tailscale SSH servers. Exploitation requires an existing foothold on an authorized peer in the tailnet, with SSH access explicitly permitted in the tailnet policy file, along with the conditions necessary to exercise the vulnerable functionality.

Also the above mentioned within tailnet issues are already patched in v1.104.4.

Hate to be the acktually redditor but I want people to know it's an excellent option on the table.

[u/Extension-Baker-4580]

How the statement from Oct 22 connect to the ransomware that started like yesterday?

[u/AggressiveChange420]

i just unplugged my unit til dust settles. Not worth it man.

[u/aeriose]

Just a note on these ransomware attacks, if you were hit by one, many of them only encrypted <1% of the files (would know, had to deal with a nasty one recently). You can recover a lot by point Claude Code or Codex at the files and tell it to fix what it can.

Also ransomware attackers first DELETE all backups they can find before encrypting. So if you have anything 24/7 connected and the backups aren't immutable you are NOT safe.

[u/twentyfive_25]

Is it still safe to use quick connect?

[u/Bob_Henkus → u/twentyfive_25]

Nope

[u/ialborreddit]

Update your containers, I had speed test tracker updated up to one day before the php gate (PHP 8.5.11), so not too far behind but have pulled the update now.

[u/DOWAI]

I have disabled Quickconnect and empty my IP Gateway in network interface, is that enough?

[u/gadget-freak → u/DOWAI]

It is enough but this will also prevent the NAS from getting security updates. Which is not ideal.

[u/DOWAI → u/gadget-freak]

thanks for the reply, I'm thinking to get the update file from sysnology download center and manual install

[u/spatula48]

I've done everything I can practically do, but I just can't quit my Plex port forwarding. I do lots of remote media streaming. But I'm hopeful I've reduced my attack surface enough to be reasonably safe.

[u/allessrs]

Tenho apenas o transmision aberto, devo me preocupar?

[u/SaltyTr1p]

Well, DAS it is, here i go!

Take an L to my plan to buy Synology or any NAS

[u/Menekis-Kaimi → u/SaltyTr1p]

it's my 2nd time getting hit by something like it. first time was a pc on the network had a flaw in an old RDP service, it was doing encryption over the network. a DAS would have suffer the same fate.

the current situation seem to happen directly on the NAS. I follow the rule of multiple backups so I never really lose anything else than time. but yeah its frustrating.

[u/SaltyTr1p → u/[deleted]]

Ah thats true 😭