Synology NAS 設備遭惡意攻擊風險，請儘速更新系統Synology NAS Devices at Risk of Malicious Attacks – Please Update Your System Immediately

Synology（群暉科技）發布安全警訊，指出有惡意攻擊者利用過去已修補的系統安全漏洞，鎖定仍使用舊版 DSM（NAS 設備的作業系統）的設備進行攻擊。設備若遭入侵，可能導致儲存的檔案遭到加密、無法正常開啟，甚至被要求支付贖金才能取回資料（勒索軟體攻擊）。

此外，Synology 於 2026 年 10 月 22 日發布另一項安全公告，指出 PHP 程式存在重大安全漏洞（CVE-2026-109618、CVE-2026-109619，俗稱 PHP2Shell），部分 Synology 原生套件，包括 Mail Station 及 Synology Calendar，也受到影響。若使用受影響且尚未更新的套件，可能遭遠端攻擊者利用漏洞執行惡意程式，進而危害設備及資料安全。

為避免設備遭受攻擊，請有Synology NAS設備的單位同仁，儘速確認設備及相關套件版本，並採取以下防護措施：

• 檢查並更新系統： 請確認 NAS 設備的 DSM 作業系統是否已更新至 Synology 官方修補漏洞的安全版本，並將受影響的 PHP、Mail Station、Synology Calendar 等套件更新至官方提供的修補版本。
• 啟用自動更新： 建議開啟 DSM 系統及相關套件的自動更新功能，以便及時取得安全修補程式，降低遭受攻擊的風險。
• 暫時中斷網路連線： 尚未完成安全更新，且無法確認設備安全性的 NAS，建議先暫時中斷網路連線，避免設備持續暴露於攻擊風險中；完成更新及安全確認後，再恢復網路連線。
• 確認資料備份： 請確認 NAS 內的重要資料是否已有其他備份，避免設備遭受攻擊或資料遭加密時，造成重要資料遺失。

參考資訊：

1.Synology 群暉科技安全事件說明：https://www.synology.com/zh-hk/company/news/article/C3RB3R

2.Synology 安全公告（Synology-SA-24:20）：https://www.synology.com/zh-tw/security/advisory/Synology_SA_24_20

3.Synology 安全公告（Synology-SA-26:14）：https://www.synology.com/zh-tw/security/advisory/Synology_SA_26_14

 

資訊網路處

 

Synology (Synology Inc.) has issued a security alert indicating that malicious attackers are exploiting previously patched system vulnerabilities to target devices that are still running outdated versions of DSM (the operating system for NAS devices). If a device is compromised, stored files may be encrypted and become inaccessible, and users may even be asked to pay a ransom to recover their data (a ransomware attack).

In addition, on October 22, 2026, Synology issued another security advisory regarding critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), commonly known as PHP2Shell. Certain Synology native packages, including Mail Station and Synology Calendar, are also affected. If vulnerable packages have not been updated, remote attackers may exploit these vulnerabilities to execute malicious code, potentially compromising the NAS device and the security of stored data.

To prevent potential attacks, all departments and staff members using Synology NAS devices are urged to promptly check their device and package versions and take the following protective measures:

• Check and Update the System: Ensure that the NAS device’s DSM operating system has been updated to the latest security-patched version provided by Synology. Also, update affected packages, such as PHP, Mail Station, and Synology Calendar, to the latest versions containing the official security fixes.
• Enable Automatic Updates: It is recommended to enable automatic updates for DSM and related packages to ensure that security patches are installed promptly and reduce the risk of cyberattacks.
• Temporarily Disconnect from the Network: For NAS devices that have not yet been updated and whose security status cannot be confirmed, temporarily disconnect them from the network to reduce exposure to potential attacks. Reconnect the devices only after the updates have been completed and their security has been verified.
• Verify Data Backups: Ensure that important data stored on the NAS is backed up to another location to prevent data loss in the event of a cyberattack or file encryption by ransomware.

 

References:

1.Synology Security Incident Announcement:https://www.synology.com/zh-hk/company/news/article/C3RB3R

2.Synology Security Advisory (Synology-SA-24:20):https://www.synology.com/zh-tw/security/advisory/Synology_SA_24_20

3.Synology Security Advisory (Synology-SA-26:14):https://www.synology.com/zh-tw/security/advisory/Synology_SA_26_14

 

Information and Network Division