Attackers are actively exploiting critical PHP flaws to target internet-exposed NAS devices. If your files and backups are stored there, they're probably at risk.

PHP2Shell refers to two critical vulnerabilities in PHP, a scripting language used by web servers and some NAS services. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code on affected servers without logging in.

The PHP development team released security updates on October 21 for versions 8.2 through 8.5. The urgency isn't hypothetical, as Amazon detected an attempted exploit on October 17, four days before the vulnerabilities were publicly disclosed.

For NAS owners, the threat affects both software maintained by the manufacturer and applications running independently in Docker containers.…