QNAP Community reports five PHP2Shell beta builds

On October 24, QNAP Community posts reported five public beta firmware builds with security updates for PHP2Shell, covering QTS and QuTS hero. The reports mark the builds as beta; QNAP says the PHP built into either operating system is updated through NAS firmware, not by replacing PHP manually.

PHP2Shell comprises two PHP-core vulnerabilities, CVE-2026-109618 and CVE-2026-109619. QNAP rated each 9.2 under CVSS v4.0. The PHP project released fixes on October 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. NeoTeo covered the PHP releases that fix the two vulnerabilities.

Which QNAP firmware versions were reported as beta builds?

The October 24 QNAP Community notice lists two QTS builds and three QuTS hero builds with PHP2Shell security updates:

The posts describe these as public beta builds. The reported list does not provide a stable release for every affected model. The QNAP Community security notice contains the build details.

To assess whether your system falls within the reported affected scope, match its product and firmware version to QNAP advisory QSA-26-18. Notebookcheck’s October 23 summary listed QTS 6.1.0 and 5.2.11 and earlier; QuTS hero h6.1.0, h6.0.x, and h5.2.11 and earlier; and QuTScloud c5.2.9 and earlier. It also listed Note Station 3, QNE, QVR Surveillance on ARM32 models, and TVR OS.

How do you update the PHP built into QTS or QuTS hero?

QNAP says you cannot update built-in PHP independently: the update comes through NAS firmware. Its general procedure is to download the firmware package for the exact NAS model, sign in as an administrator, then open Control Panel > System > Firmware Update > Manual Installation and select the package. QNAP recommends backing up data, using a UPS and not interrupting power during installation. Its manual firmware instructions describe that process; they do not make a particular beta build appropriate for every NAS.

The PHP environment available through Container Station or Virtualization Station is separate from the NAS’s built-in PHP. QNAP’s FAQ on built-in PHP explains that distinction. For Container Station, a patched image does not update a container that is already running; Notebookcheck notes that owners must recreate the container to use the new image.

Reduce public exposure while arranging an update

QNAP’s interim advice is to disable router port forwarding and UPnP, use a VPN for remote access, and restrict management ports to trusted networks. It also recommends removing unnecessary public services and stopping PHP-based apps or the built-in web server when they are not needed. These steps reduce exposure; they do not replace a firmware update.