Vulnerabilities in PHP Affecting Multiple QNAP and Synology Products

Audio Systems
1

For those of us running a QNAP NAS it is good to be aware of this, and take precautions:

https://www.qnap.com/en/security-advisory/qsa-26-18

EDIT: The same might go for Synology NAS systems. They did not publish about it yet, but they have it under investigation:

EDIT 2: Added NCSC UK warning. It looks like this issue is getting less attention abroad than in mainland Europe.

3 Likes
2

By the way, QNAP vulnerabilities are also tracked by Anthropic’s Mythos. All things considered, they’re doing pretty well. Synology is MIA.

https://mythoscvetracker.com

Mythos CVE Tracker
Mythos CVE Tracker1608Ă—755 124 KB

2 Likes
3

However they seem to have issued updates in regard to this security issue.

II appreciate that this not my usual area of interest but I thought that the link may be of use to those for whom it is relevant.

4

Thanks Pete.

Actually, my Synology comments was not in relation to this PHP CVE, but a general one with-respect-to Synology apparently not using the Anthropic Mythos model to probe their OS for vulnerability exposures.

Mythos is incredibly powerful, and typically much better than any internal security testing team. My guess is Synology doesn’t want to spend $$ for access to the model. Which basically makes their platform less secure than others.

1 Like