Synology SA-26:14 Fixes Critical PHP2Shell RCE in DSM Packages
Tech GuruQuick Answer
Synology-SA-26:14 fixes CVE-2026-109618 and CVE-2026-109619 in Calendar, Mail Station, and supported PHP packages. Match each DSM package to the listed fixed release, update it, remove or migrate unsupported PHP 7.3, validate application exposure and operation, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory DSM package versions, application exposure, dependencies, owners, and backups; install each advisory-listed fixed Calendar, Mail Station, or PHP package; migrate unsupported PHP 7.3; verify versions and network paths; test applications; review relevant logs; and retain evidence.
Last verified: 2026-10-22 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Synology Calendar, Mail Station, and PHP packages installed on DSM |
|---|---|
| Advisory | Synology-SA-26:14 |
| CVEs | CVE-2026-109618, CVE-2026-109619 |
| Authoritative release date | 2026-10-22 11:45:00 UTC |
| Authority revision date | 2026-10-22 11:51:04 UTC |
| Affected versions | Synology Calendar before 3.0.4-21435; Mail Station before 30000002.3.19-20333; PHP 7.4 before 7.4.33-0131; PHP 8.0 before 8.0.30-0122; PHP 8.1 before 8.1.34-0120; PHP 8.2 before 8.2.35-0171; PHP 8.3 before 8.3.36-0051; PHP 8.4 before 8.4.27-0051; PHP 7.3 is end of life and will not receive a fix. |
| Fixed version | Calendar 3.0.4-21435; Mail Station 30000002.3.19-20333; or the advisory-listed fixed PHP package; remove or migrate PHP 7.3 |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Synology does not state that these vulnerabilities are being maliciously exploited; no exploitation claim is inferred. |
What Changed
Synology published product-specific remediation for the two PHP2Shell use-after-free vulnerabilities. Susceptible DSM packages can permit remote code execution; the authority says built-in operating-system PHP is not exposed to external attack surfaces and assesses its exploitation risk as very low.
What To Validate Now
- Inventory. Identify DSM systems, installed Calendar, Mail Station and PHP packages, exact package versions, externally reachable application paths, PHP 7.3 dependencies, owners, backups, and maintenance windows.
- Establish applicability. Match each installed package to Synology-SA-26:14 and the package-specific fixed release. Distinguish separately installed packages from built-in operating-system PHP; do not infer internet exposure or safety from the platform name alone.
- Remediate. Install the advisory-listed fixed package through Synology Package Center or the supported channel. Remove or migrate PHP 7.3 because Synology states that no fix will be provided for that end-of-life branch.
- Validate. Confirm the installed package versions and service state, verify intended exposure and reverse-proxy rules, test Calendar, Mail Station, and dependent PHP applications, review relevant logs where exposure existed, and retain package and change evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Synology distinguishes separately installed packages from built-in operating-system PHP, which it says is not exposed to external attack surfaces and presents very low exploitation risk. Validate the actual package and exposure path; do not apply that statement to hosted applications automatically.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
