QNAP rolls out vital firmware fixes for "PHP2Shell" security vulnerabilities in network-attached storage systems. Critical security issues exist in network-attached storage (NAS) systems developed by QNAP that enable unauthorized remote code execution on affected devices with no authentication. Affected OS users should promptly install patches to avoid potential remote access attacks. Otherwise, your data may face the threat of being exploited through basic network requests.
Critical firmware patches address authentication bypass flaws in QTS and QuTS hero operating systems
The firmware fixes are available for QTS, QuTS hero, and QuTScloud operating systems. Affected versions include, but are not limited to: QTS 6.1.0/QTS 5.2.11/Older versions. QuTS hero's versions are also affected, including h6.1.0/h6.0.x/h5.2.11. Additionally, QuTScloud's versions c5.2.9 and older need urgent attention.
Several software packages running on QNAP NAS systems also have critical security vulnerabilities. For example: Note Station 3 versions 3.9.14 and older are vulnerable to remote code execution vulnerabilities. The application QNE (ADRA), version 1.0.7 and older, needs urgent fixes. QVR Surveillance for some ARM32 platforms (version 3.0.3 and older) is affected as well.
TVR OS (version 1.0.4 and older versions) are in the list of affected software. Affected CVE IDs are CVE-2026-109618 and CVE-2026-109619. An attacker can exploit the vulnerabilities by sending specific malicious requests through the network. To minimize potential attacks while users are not able to install firmware fixes immediately, QNAP recommends disabling port forwarding and UPnP.
Vital security vulnerabilities have been fixed in the firmware updates released for QNAP NAS systems. They fix authentication bypass vulnerabilities that allow remote code execution. System administrators should check if their QNAP NAS systems are affected and verify the software version. Users can fix affected devices by installing the latest firmware.
Does the QTS 6.1.0 patch include the fix for Note Station 3 version 3.9.14 or is that a separate package update?
Note Station 3 is listed separately in the advisory. You likely need to update that app specifically in the App Center.
php2shell sounds like a nightmare to patch 😅
The CVEs are CVE-2026-109618 and CVE-2026-109619. Do not confuse these with older QNAP exploits.
I disabled port forwarding years ago. This just confirms I did the right thing.
QuTScloud c5.2.9 is also affected if you are on the cloud platform.
Finally some good news for enterprise storage security.