CybersecurityNov 2, 2026 · AltTab Dad

Synology NAS ransomware (C3RB3R): am I affected, and how do I check my DSM version?

Am I affected?

Who’s affected

• Synology NAS owners on old DSM builds, below the fixed versions in Synology’s advisory SA-24:20 (Synology advisory).
• Highest risk: boxes whose admin page (DSM web interface) can be reached from the internet. Shadowserver tracks more than 380,000 internet-exposed Synology NAS devices (BleepingComputer).
• Newer bugs may be in play: several security firms (360, TrebSec, RocketZero) link the attacks to two newer bugs, CVE-2026-13639 and CVE-2026-13684, which Synology fixed on Sep 18, 2026 in SA-26:13. That advisory needs at least 7.2.2-72806-9, 7.2.1-69057-12, 7.3.2-86009-4 or 7.4-90075 (Synology SA-26:13). Synology itself hasn’t confirmed which bug is being used (TrebSec, RocketZero).
• Patched isn’t a guarantee: one incident response team reports a victim that was already running a recent DSM 7.4.1 build. That report is unconfirmed, but it means a current DSM lowers your risk rather than ruling this attack out (TrebSec).

How to check (60 seconds)

1. Sign in to DSM and open Control Panel > Update & Restore. The current DSM version is shown at the top.
2. Install the latest build offered for your version line. The SA-24:20 minimums (DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7, 6.2.4-25556-8) are only an older floor and aren’t enough on their own (Synology advisory). On 7.2.1, 7.2.2, 7.3 and 7.4 you need at least the SA-26:13 builds listed above (Synology SA-26:13).
3. Signs you were hit: files ending in .L0CK3D, or a read-me3.txt file in your shared folders (BleepingComputer).

What to do

1. Install the latest DSM build for your version line in Control Panel > Update & Restore, then confirm the new version number.
2. Update PHP and the affected add-on packages in Package Center. Synology advises this for anyone using PHP-based packages such as Calendar, Mail Station, Web Station or WordPress. Most restart on their own after the PHP update, but Mail Station needs its own manual update (Synology, Synology SA-26:14).
3. Turn on automatic updates in Control Panel > Update & Restore. Synology recommends it (Synology).
4. Take the NAS off the internet: turn off QuickConnect, remove router port forwards to DSM (by default ports 5000/5001) and turn off UPnP for the NAS. Turn off Telnet, and SSH too unless you use it (Control Panel > Terminal & SNMP). Use a VPN if you need remote access. BleepingComputer’s guidance is to block internet access to the management interface (BleepingComputer), and RocketZero notes QuickConnect also makes the sign-in page reachable.
5. Use strong passwords and turn on 2FA (two-step verification) for every account. They don’t stop a DSM bug by themselves, but they close the credential route that responders haven’t ruled out (TrebSec).
6. Check your backups: make sure at least one copy lives off the NAS (USB drive or cloud) and that Snapshot Replication is on where your model supports it.
7. If you find encrypted files: unplug the NAS from the network, don’t pay or download any “decryptor,” and contact Synology support before you restore from a clean backup.

What happened

• Dec 2024: Synology finished shipping fixes for the SA-24:20 bugs, including CVE-2024-10441, a critical (9.8) remote code execution flaw (Synology advisory).
• Sep 18, 2026: Synology fixed CVE-2026-13639 and CVE-2026-13684, both rated critical (9.8), in SA-26:13 (Synology SA-26:13).
• Mid-October 2026: owners began reporting encrypted files and a ransom note pushing a “C3rb3r Decryptor” (BleepingComputer).
• Oct 29, 2026: Synology warned customers and urged everyone on vulnerable versions to update (Synology).
• Nov 2, 2026: BleepingComputer reported the attack wave and noted Synology’s last warning like this came in 2019 (BleepingComputer).

Why it matters

• A home NAS often holds the family photo archive and the backups, so ransomware there hits the copy you’d restore from.
• Synology points to a fix that’s almost two years old, while security firms point to bugs fixed only in September. Either way, the latest build for your DSM line covers both advisories where Synology has published fixes.

FAQ

• Is my Synology affected if it’s not reachable from the internet? The risk is far lower, but still update. Synology says to update every vulnerable version.
• Is a fully updated NAS safe? It’s much safer, not guaranteed. One unconfirmed report describes a victim on a recent DSM 7.4.1 build, so also keep it off the internet and use 2FA.
• Which bug is being used? Synology hasn’t said. It points to advisory SA-24:20, which covers three CVEs. Several security firms (360, TrebSec, RocketZero) link the attacks to the newer CVE-2026-13639 and CVE-2026-13684 from SA-26:13.
• Is PHP2Shell behind these attacks? Not confirmed. Synology says it found the ransomware attacks while investigating PHP2Shell, critical flaws in PHP and PHP-based packages that it fixed in SA-26:14, and it advises updating PHP and the affected packages (Synology, Synology SA-26:14). Hong Kong’s HKCERT gives the same advice and notes that Synology “has not confirmed whether PHP2Shell was involved” (HKCERT).
• Should I pay the ransom? No. There’s no guarantee it works. Restore from a clean backup and contact Synology support.
• Does auto-update fix this for good? It keeps you on current builds, which closes the known holes as fixes ship. Pair it with keeping DSM off the internet.

Updated Nov 2, 2026: We changed the main advice from “update to the SA-24:20 fixed builds” to “install the latest DSM build for your version line,” because several security firms link the attacks to newer bugs fixed in SA-26:13 (Sep 18, 2026). We added that advisory’s minimum builds, softened the line saying a current DSM isn’t reached after an unconfirmed report of a victim on DSM 7.4.1, and added steps to turn off QuickConnect, port forwarding, Telnet and SSH and to use strong passwords with 2FA. We also added a step to update PHP and the affected add-on packages in Package Center, plus an FAQ on PHP2Shell (SA-26:14), after Synology’s US statement and Hong Kong’s HKCERT advised it.