QNAP has warned that two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in PHP itself threaten QTS, QuTS hero, QuTScloud and several QNAP apps. The flaws permit unauthenticated, remote code execution, with exploitation attempts already observed in the wild, though QNAP has not confirmed attacks specifically targeting its devices.
The PHP project fixed these issues on 21 October 2026 in PHP versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and the QNAP advisory notes that patches are not yet available for affected devices.
The vulnerabilities allow memory exhaustion and access to memory freed by earlier requests, enabling code execution or memory leaks without any application-level authentication. Public PoC exploits exist and are broad for PHP servers in general; however, the article indicates no definitive reports of QNAP device exploitation to date.
Affected QNAP products include QTS 6.1.0 and 5.2.11 and earlier, QuTS hero h6.1.0 and h6.0.x and earlier, QuTScloud c5.2.9 and earlier, along with Note Station 3 3.9.14 and earlier, QNE 1.0.7 and earlier, QVR Surveillance 3.0.3 and earlier on ARM32 models, and TVR OS 1.0.4 and earlier.
In the meantime, QNAP recommends keeping devices offline from the internet and implementing mitigations: disable port forwarding and UPnP; switch off myQNAPcloud Link and unpublish unnecessary services; use VPN for remote access; restrict management ports to trusted subnets via QuFirewall; and disable unneeded PHP-based apps and the built-in web server. If a compromise is suspected, disconnect the device, rotate passwords and contact QNAP Support. Patches are expected to ship later; users should monitor for updates.