{"id":22083,"date":"2026-10-23T05:56:32","date_gmt":"2026-10-22T21:56:32","guid":{"rendered":"https:\/\/synopower.club\/?p=22083"},"modified":"2026-10-23T05:56:32","modified_gmt":"2026-10-22T21:56:32","slug":"synology-php2shell-emergency-patch","status":"publish","type":"post","link":"https:\/\/synopower.club\/cs\/synology-php2shell-emergency-patch\/","title":{"rendered":"PHP2Shell na Synology: Jak jsme za jeden den opravili \u0161est web\u016f"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>PHP2Shell<\/strong> je n\u00e1zev, na kter\u00e9m se odv\u011btv\u00ed dohodlo pro CVE-2026-109618 a CVE-2026-109619, dvojici kritick\u00fdch chyb v samotn\u00e9m PHP enginu, kter\u00e9 umo\u017e\u0148uj\u00ed neov\u011b\u0159en\u00e9 vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du. Podrobnosti unikly 20. \u0159\u00edjna 2026, den p\u0159ed koordinovan\u00fdm odhalen\u00edm, a projekt PHP vydal nouzov\u00e9 verze 21. \u0159\u00edjna. Proto\u017ee se chyba nach\u00e1z\u00ed v interpretu a nikoli v \u017e\u00e1dn\u00e9 aplikaci, z\u00e1platov\u00e1n\u00ed WordPressu, Joomly nebo MediaWiki ned\u011bl\u00e1 v\u016fbec nic. Jedinou skute\u010dnou opravou je nov\u00e1 verze PHP. Na hardwaru Synology provozujeme \u0161est ve\u0159ejn\u00fdch web\u016f WordPress a PHP2Shell znamenal, \u017ee ka\u017ed\u00fd z nich musel b\u00fdt znovu sestaven ve stejn\u00e9m t\u00fddnu. Tato p\u0159\u00edru\u010dka se zab\u00fdv\u00e1 t\u00edm, co chyba vlastn\u011b je, jak ji opravit v DSM prost\u0159ednictv\u00edm Centra bal\u00ed\u010dk\u016f, jak se s n\u00ed vypo\u0159\u00e1dat, kdy\u017e v\u00e1\u0161 web b\u011b\u017e\u00ed v kontejneru, a nep\u0159\u00edjemn\u00fdm srovn\u00e1n\u00edm mezi t\u00edm, co dodal Synology, a t\u00edm, co se dosud poda\u0159ilo ostatn\u00edm dodavatel\u016fm NAS.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Bod SynoPower Club\uff1a<\/strong>Na\u0161ich \u0161est web\u016f bylo opraveno b\u011bhem jednoho pracovn\u00edho dne od vyd\u00e1n\u00ed ozn\u00e1men\u00ed PHP2Shell a \u010d\u00e1st, kter\u00e1 to umo\u017enila, nebyl hrdinsk\u00fd \u010din, ale zve\u0159ejn\u011bn\u00ed opraven\u00fdch bal\u00ed\u010dk\u016f ze strany Synology ve stejn\u00fd den jako ozn\u00e1men\u00ed. Oprava Synology-SA-26:14 byla zve\u0159ejn\u011bna 22. \u0159\u00edjna se stavem Vy\u0159e\u0161eno a kompletn\u00ed tabulkou opraven\u00fdch verz\u00ed a\u017e do PHP 7.4. Ve stejn\u00fd den spole\u010dnost QNAP zve\u0159ejnila QSA-26-18 se stavem Oprava a slovy Bude ozn\u00e1meno v ka\u017ed\u00e9 bu\u0148ce s opraven\u00fdmi verzemi a spole\u010dnost ASUSTOR reagovala odstran\u011bn\u00edm star\u0161\u00edho PHP z App Central, m\u00edsto aby jej opravovala. Pokud si sami hostujete ve\u0159ejn\u00fd web na NAS, tato mezera nen\u00ed marketingov\u00fdm detailem. Je to rozd\u00edl mezi aktualizac\u00ed bal\u00ed\u010dku a odstran\u011bn\u00edm webu z internetu na po\u010dk\u00e1n\u00ed.<\/p>\n<\/blockquote>\n\n\n\n<h2 id=\"what-is-php2shell-and-why-it-is-different\" class=\"wp-block-heading\">Co je PHP2Shell a pro\u010d se li\u0161\u00ed<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell nen\u00ed jedna chyba, ale shluk souvisej\u00edc\u00edch chyb zabezpe\u010den\u00ed pam\u011bti v tom, jak PHP \u010dist\u00ed po po\u017eadavku, kter\u00e9mu do\u0161la pam\u011b\u0165. PHP pou\u017e\u00edv\u00e1 <code>longjmp()<\/code> aby se vyhnul fat\u00e1ln\u00edm chyb\u00e1m, v\u010detn\u011b nedostatku pam\u011bti, a tento skok p\u0159eskakuje \u010distic\u00ed k\u00f3d, kter\u00fd by norm\u00e1ln\u011b uvedl engine zp\u011bt do zn\u00e1m\u00e9ho stavu. \u010c\u00e1st tohoto stavu je glob\u00e1ln\u00ed a p\u0159etrv\u00e1v\u00e1 do dal\u0161\u00edho po\u017eadavku zpracovan\u00e9ho stejn\u00fdm pracovn\u00edm procesem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-109618 je str\u00e1nka s nedostatkem pam\u011bti. Vytvo\u0159en\u00fd HTTP po\u017eadavek vy\u010derp\u00e1 limit pam\u011bti, zat\u00edmco data po\u017eadavku jsou inicializov\u00e1na pouze \u010d\u00e1ste\u010dn\u011b, tak\u017ee rutina \u010di\u0161t\u011bn\u00ed proch\u00e1z\u00ed strukturami, kter\u00e9 nebyly nikdy dokon\u010deny. CVE-2026-109619 je str\u00e1nka s pou\u017eit\u00edm po uvoln\u011bn\u00ed pam\u011bti: glob\u00e1ln\u00ed stav ponechan\u00fd ukazuj\u00edc\u00ed na uvoln\u011bnou pam\u011b\u0165 po\u017eadavku m\u016f\u017ee b\u00fdt p\u0159e\u010dten pozd\u011bj\u0161\u00edm po\u017eadavkem na stejn\u00e9m workeru, co\u017e je zp\u016fsob, jak\u00fdm se chyba m\u011bn\u00ed ve spu\u0161t\u011bn\u00ed k\u00f3du nebo odhalen\u00ed pam\u011bti.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dv\u011b vlastnosti d\u011blaj\u00ed PHP2Shell hor\u0161\u00edm ne\u017e obvykl\u00e9 PHP doporu\u010den\u00ed. Zaprv\u00e9, je p\u0159edb\u011b\u017en\u00e9 ov\u011b\u0159ov\u00e1n\u00ed. Ob\u011b chyby se aktivuj\u00ed p\u0159ed spu\u0161t\u011bn\u00edm ov\u011b\u0159ov\u00e1n\u00ed na \u00farovni aplikace, tak\u017ee p\u0159ihla\u0161ovac\u00ed ze\u010f, plugin pro \u010dlenstv\u00ed ani heslo spr\u00e1vce nic nechr\u00e1n\u00ed. Zadruh\u00e9, varianta memory-disclosure unik\u00e1 pam\u011b\u0165 pracovn\u00edch proces\u016f a PHP pracovn\u00ed proces na webu WordPress uchov\u00e1v\u00e1 p\u0159ihla\u0161ovac\u00ed \u00fadaje k datab\u00e1zi, tokeny API a platebn\u00ed kl\u00ed\u010de. \u00dasp\u011b\u0161n\u00e9 \u010dten\u00ed nemus\u00ed dos\u00e1hnout spu\u0161t\u011bn\u00ed k\u00f3du, aby v\u00e1m zkazilo t\u00fdden.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dva PHP2Shell CVE byly bezpe\u010dnostn\u00edm t\u00fdmem PHP ohodnoceny v CVSS v4.0 na 9,2. Synology jim ve sv\u00e9m vlastn\u00edm doporu\u010den\u00ed ud\u011blil v CVSS v3.1 hodnocen\u00ed 9,8. R\u016fzn\u00e1 \u0161k\u00e1lov\u00e1n\u00ed, stejn\u00fd z\u00e1v\u011br. Zpr\u00e1vy o zneu\u017eit\u00ed jsou sm\u00ed\u0161en\u00e9: watchTowr uv\u00e1d\u00ed, \u017ee zaznamenal pokusy o \u00fatok na svou honeypot s\u00ed\u0165, zat\u00edmco Bitdefender v dob\u011b psan\u00ed tohoto \u010dl\u00e1nku ve sv\u00e9 telemetrii nic nehl\u00e1sil a QNAP uv\u00e1d\u00ed, \u017ee neobdr\u017eel \u017e\u00e1dn\u00e9 zpr\u00e1vy o zneu\u017eit\u00ed zam\u011b\u0159en\u00e9m konkr\u00e9tn\u011b na produkty QNAP.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"eager\" decoding=\"async\" width=\"1400\" height=\"852\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory.webp\" alt=\"Synology-SA-26:14 Informa\u010dn\u00ed hl\u00e1\u0161en\u00ed PHP2Shell zobrazuj\u00edc\u00ed stav Vy\u0159e\u0161eno a tabulku opraven\u00fdch verz\u00ed\" class=\"wp-image-22078\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory-300x183.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory-1024x623.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory-768x467.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory-18x12.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory-600x365.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory-400x243.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-synology-advisory-1000x609.webp 1000w\"  fetchpriority=\"high\"\/><figcaption class=\"wp-element-caption\">Synology-SA-26:14, publikov\u00e1no 22. \u0159\u00edjna 2026 v 19:45 UTC+8 se stavem Vy\u0159e\u0161eno.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"php2shell-vs-a-normal-wordpress-exploit\" class=\"wp-block-heading\">PHP2Shell vs. b\u011b\u017en\u00fd exploit ve WordPressu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">V\u011bt\u0161ina zranitelnost\u00ed, kter\u00e9 postihnou ve\u0159ejn\u00fd web WordPressu, jsou pluginy. Vzorec je zn\u00e1m\u00fd: plugin ode\u0161le nefunk\u010dn\u00ed REST endpoint, skener ho najde, vy plugin aktualizujete a d\u00edra se uzav\u0159e. PHP2Shell tento zvyk zcela ru\u0161\u00ed a reflex auditov\u00e1n\u00ed plugin\u016f je zde zbyte\u010dn\u00fdm \u00fasil\u00edm.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Aspekt<\/th><th>Typick\u00e9 CVE pluginu<\/th><th>PHP2Shell<\/th><\/tr><\/thead><tbody><tr><td>Kde \u017eije brouk<\/td><td>K\u00f3d aplikace (plugin nebo \u0161ablona)<\/td><td>Samotn\u00fd interpret PHP<\/td><\/tr><tr><td>Kdo to m\u016f\u017ee spustit<\/td><td>\u010casto vy\u017eaduje roli odb\u011bratele nebo administr\u00e1tora<\/td><td>Nikdo. P\u0159edb\u011b\u017en\u00e9 ov\u011b\u0159ov\u00e1n\u00ed, p\u0159ed spu\u0161t\u011bn\u00edm logiky aplikace.<\/td><\/tr><tr><td>Pom\u00e1h\u00e1 aktualizace WordPressu?<\/td><td>Obvykle ano<\/td><td>Ne. Aktualizace j\u00e1dra a plugin\u016f nejsou relevantn\u00ed.<\/td><\/tr><tr><td>Zastav\u00ed to WAF?<\/td><td>Obvykle, jakmile pravidlo existuje<\/td><td>\u010c\u00e1ste\u010dn\u011b. Pravidla Request-shape minou cestu OOM.<\/td><\/tr><tr><td>Co to vlastn\u011b oprav\u00ed<\/td><td>Aktualizace pluginu<\/td><td>Nov\u00e1 PHP sestava, nic v\u00edc<\/td><\/tr><tr><td>Polom\u011br v\u00fdbuchu<\/td><td>Jeden web, jedna funkce<\/td><td>V\u0161echny PHP str\u00e1nky najednou<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Pr\u00e1v\u011b ten posledn\u00ed \u0159\u00e1dek je d\u016fvodem, pro\u010d se PHP2Shell prom\u011bnil v celodenn\u00ed pr\u00e1ci m\u00edsto odpoledne. Jeden sd\u00edlen\u00fd PHP bal\u00ed\u010dek na NAS m\u016f\u017ee b\u00fdt za tuctem virtu\u00e1ln\u00edch hostitel\u016f Web Station a jeden image kontejneru m\u016f\u017ee b\u00fdt z\u00e1kladem pro n\u011bkolik web\u016f. Opravy se neinstaluj\u00ed pro jednotliv\u00e9 weby, ale pro jednotliv\u00e9 b\u011bhov\u00e9 prost\u0159ed\u00ed, a ne\u017e m\u016f\u017eete tvrdit, \u017ee je n\u011bco hotov\u00e9, mus\u00edte vyjmenovat b\u011bhov\u00e1 prost\u0159ed\u00ed.<\/p>\n\n\n\n<h2 id=\"how-to-tell-if-your-nas-is-exposed\" class=\"wp-block-heading\">Jak zjistit, zda je v\u00e1\u0161 NAS odhalen\u00fd<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Zji\u0161t\u011bn\u00ed va\u0161\u00ed expozice v PHP2Shell za\u010d\u00edn\u00e1 odd\u011blen\u00edm dvou r\u016fzn\u00fdch ot\u00e1zek. Obsahuje krabice zranitelnou PHP sestavu a je tato sestava dostupn\u00e1 z internetu? Synology toto rozli\u0161en\u00ed explicitn\u011b uv\u00e1d\u00ed: DSM dod\u00e1v\u00e1 intern\u00ed PHP komponentu pou\u017e\u00edvanou opera\u010dn\u00edm syst\u00e9mem a Synology uv\u00e1d\u00ed, \u017ee nem\u00e1 \u017e\u00e1dn\u00e9 extern\u011b p\u0159\u00edstupn\u00e9 moduly, a proto \u017e\u00e1dnou odhalenou oblast \u00fatoku. Riziko, kter\u00e9 t\u00e9to komponent\u011b p\u0159i\u0159azuje, je minim\u00e1ln\u00ed a oprava je napl\u00e1nov\u00e1na na pozd\u011bj\u0161\u00ed vyd\u00e1n\u00ed DSM, aby ji skenov\u00e1n\u00ed zranitelnost\u00ed p\u0159estalo ozna\u010dovat.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pro PHP2Shell jsou d\u016fle\u017eit\u00e9 bal\u00ed\u010dky, kter\u00e9 poskytuj\u00ed PHP na webu. Synology uv\u00e1d\u00ed Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station a WordPress. Pokud m\u00e1te n\u011bkter\u00fd z nich nainstalovan\u00fd a dostupn\u00fd, jste v rozsahu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zkontrolujte verze p\u0159\u00edmo, m\u00edsto abyste se spol\u00e9hali na dashboard. V Centru bal\u00ed\u010dk\u016f se verze nainstalovan\u00fdch PHP bal\u00ed\u010dk\u016f zobrazuj\u00ed na dla\u017edici a ozn\u00e1men\u00ed o aktualizaci pojmenov\u00e1v\u00e1 c\u00edlov\u00e9 sestaven\u00ed. Zeptejte se samotn\u00e9ho b\u011bhov\u00e9ho prost\u0159ed\u00ed:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Synology PHP bal\u00ed\u010dek (upravte cestu k verzi, kterou pou\u017e\u00edv\u00e1te) \/volume1\/@appstore\/PHP8.2\/usr\/local\/bin\/php -v # Kontejnerov\u00fd docker exec pro web php -v<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">D\u016fvod, pro\u010d trvat na <code>php -v<\/code> Probl\u00e9m p\u0159i auditu PHP2Shell je v tom, \u017ee v\u0161echny ostatn\u00ed sign\u00e1ly l\u017eou. V\u00fdstup sestaven\u00ed m\u016f\u017ee hl\u00e1sit \u00fasp\u011bch p\u0159i op\u011btovn\u00e9m pou\u017eit\u00ed vrstvy z mezipam\u011bti, dashboard m\u016f\u017ee zobrazit bal\u00ed\u010dek jako aktu\u00e1ln\u00ed, i kdy\u017e spu\u0161t\u011bn\u00fd worker nen\u00ed, a hlavi\u010dku odpov\u011bdi HTTP m\u016f\u017ee CDN odstranit d\u0159\u00edve, ne\u017e ji v\u016fbec uvid\u00edte. Dva z na\u0161ich \u0161esti web\u016f byly na jejich administr\u00e1torsk\u00fdch obrazovk\u00e1ch hl\u00e1\u0161eny jako v po\u0159\u00e1dku, i kdy\u017e st\u00e1le b\u011b\u017eel neopraven\u00fd interpret.<\/p>\n\n\n\n<h2 id=\"patching-php2shell-on-synology-in-4-steps\" class=\"wp-block-heading\">Aktualizace PHP2Shell na Synology ve 4 kroc\u00edch<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pro web Web Station v DSM je cel\u00e1 oprava PHP2Shell aktualizac\u00ed Centra bal\u00ed\u010dk\u016f. Synology publikuje aktualizace zabezpe\u010den\u00ed PHP pro DSM 7.4, 7.3 a 7.2 a po aktualizaci bal\u00ed\u010dk\u016f PHP se z\u00e1visl\u00e9 bal\u00ed\u010dky samy restartuj\u00ed, co\u017e probl\u00e9m \u0159e\u0161\u00ed. Mail Station je zdokumentovanou v\u00fdjimkou a vy\u017eaduje samostatnou ru\u010dn\u00ed aktualizaci.<\/p>\n\n\n<div id=\"rank-math-howto\" class=\"rank-math-block\" >\n<div class=\"rank-math-howto-description\">\n\n<\/div>\n\n<div class=\"rank-math-steps\">\n<div id=\"step-1\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Zkontrolujte si doporu\u010den\u00ed<\/h3>\n<div class=\"rank-math-step-content\"><p>Otev\u0159ete soubor Synology-SA-26:14 a poznamenejte si opravenou verzi pro ka\u017edou nainstalovanou v\u011btev PHP. C\u00edlov\u00e9 verze jsou 7.4.33-0131, 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 a 8.4.27-0051. PHP 7.3 nem\u00e1 opravu, proto\u017ee je na konci sv\u00e9 \u017eivotnosti.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-2\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Aktualizace prost\u0159ednictv\u00edm Centra bal\u00ed\u010dk\u016f<\/h3>\n<div class=\"rank-math-step-content\"><p>V syst\u00e9mu DSM otev\u0159ete Centrum bal\u00ed\u010dk\u016f a pod\u00edvejte se na Nainstalov\u00e1no. Ka\u017ed\u00fd zraniteln\u00fd bal\u00ed\u010dek PHP zobrazuje stav Aktualizace dostupn\u00e1 s novou online verz\u00ed. Klikn\u011bte na Aktualizovat u ka\u017ed\u00e9 uveden\u00e9 v\u011btve PHP a aktualizujte kalend\u00e1\u0159 a po\u0161tovn\u00ed stanici Synology, pokud je m\u00e1te nainstalov\u00e1ny.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-3\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Nechte z\u00e1visl\u00e9 osoby restartovat<\/h3>\n<div class=\"rank-math-step-content\"><p>Bal\u00ed\u010dky z\u00e1visl\u00e9 na PHP se po dokon\u010den\u00ed aktualizace bal\u00ed\u010dku PHP automaticky restartuj\u00ed a pr\u00e1v\u011b tento restart aktivuje opravu. V\u00fdjimkou je Mail Station, kter\u00fd je nutn\u00e9 aktualizovat ru\u010dn\u011b z Centra bal\u00ed\u010dk\u016f.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-4\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Ov\u011b\u0159te spu\u0161t\u011bn\u00fd interpret<\/h3>\n<div class=\"rank-math-step-content\"><p>Ned\u016fv\u011b\u0159ujte dashboardu. Spus\u0165te p\u0159\u00edkaz php -v pro cestu k bal\u00ed\u010dku nebo uvnit\u0159 kontejneru a ov\u011b\u0159te, zda \u010d\u00edslo sestaven\u00ed odpov\u00edd\u00e1 varov\u00e1n\u00ed. Pot\u00e9 zkontrolujte, zda je ka\u017ed\u00fd virtu\u00e1ln\u00ed hostitel webov\u00e9 stanice v\u00e1z\u00e1n na profil, kter\u00fd jste skute\u010dn\u011b aktualizovali.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"803\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82.webp\" alt=\"Centrum bal\u00ed\u010dk\u016f Synology zobrazuj\u00edc\u00ed dostupnou aktualizaci PHP 8.2 na verzi 8.2.35-0171\" class=\"wp-image-22079\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82-300x172.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82-1024x587.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82-768x441.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82-18x10.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82-600x344.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82-400x229.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-php82-1000x574.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Centrum bal\u00ed\u010dk\u016f nab\u00edz\u00ed PHP 8.2.35-0171, sestaven\u00ed uveden\u00e9 v informa\u010dn\u00ed zpr\u00e1v\u011b.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">V\u00fd\u0161e uveden\u00fd sn\u00edmek obrazovky poch\u00e1z\u00ed z jednoho z na\u0161ich vlastn\u00edch po\u010d\u00edta\u010d\u016f r\u00e1no po ozn\u00e1men\u00ed PHP2Shell. V panelu Co je nov\u00e9ho je p\u0159\u00edmo uvedena verze upstreamu, tak\u017ee m\u016f\u017eete p\u0159\u00edponu sestaven\u00ed Synology porovnat s verz\u00ed PHP bez h\u00e1d\u00e1n\u00ed. Kalend\u00e1\u0159 Synology se objevuje ve stejn\u00e9m seznamu aktualizac\u00ed pod \u010d\u00edslem 3.0.4-21435, co\u017e je p\u0159esn\u011b verze, kterou ozn\u00e1men\u00ed po\u017eaduje.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"793\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update.webp\" alt=\"Dialogov\u00e9 okno pro potvrzen\u00ed nastaven\u00ed Centra bal\u00ed\u010dk\u016f Synology p\u0159i aktualizaci PHP 8.2 na 8.2.35-0171\" class=\"wp-image-22080\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update-300x170.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update-1024x580.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update-768x435.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update-18x10.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update-600x340.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update-400x227.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-package-center-update-1000x566.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Dialogov\u00e9 okno aktualizace s n\u00e1zvem PHP 8.2.35-0171, publikovan\u00e9 spole\u010dnost\u00ed Synology Inc.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Jedna past PHP2Shell, kterou stoj\u00ed za to jmenovat pro u\u017eivatele Web Station: po\u010d\u00edta\u010d s DSM m\u016f\u017ee m\u00edt nainstalov\u00e1no n\u011bkolik v\u011btv\u00ed PHP najednou a ka\u017ed\u00fd virtu\u00e1ln\u00ed hostitel je v\u00e1z\u00e1n na jeden profil. Aktualizace v\u00fdchoz\u00edho profilu nepom\u016f\u017ee webu p\u0159ipnut\u00e9mu k jin\u00e9 v\u011btvi. Nejprve vyjmenujte profily, aktualizujte je v\u0161echny a pot\u00e9 zkontrolujte vazbu ka\u017ed\u00e9ho webu v \u010d\u00e1sti Web Service.<\/p>\n\n\n\n<h2 id=\"which-dsm-packages-are-affected\" class=\"wp-block-heading\">Kter\u00e9 bal\u00ed\u010dky DSM jsou ovlivn\u011bny<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Prohl\u00e1\u0161en\u00ed Synology o PHP2Shell je u\u017e\u0161\u00ed, ne\u017e nazna\u010dovala panika. T\u00fdk\u00e1 se to pouze syst\u00e9m\u016f s ur\u010dit\u00fdmi bal\u00ed\u010dky z\u00e1visl\u00fdmi na PHP a Synology Drive mezi n\u011b v\u00fdslovn\u011b nepat\u0159\u00ed. IDrive je na seznamu, ale je to software t\u0159et\u00ed strany.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Webov\u00fd p\u0159\u00edstup a nejvy\u0161\u0161\u00ed priorita.<\/strong> Web Station, WordPress, Joomla, MediaWiki, vtigerCRM, KodExplorer a phpMyAdmin. Tyto syst\u00e9my poskytuj\u00ed PHP komukoli, kdo k nim m\u00e1 p\u0159\u00edstup.<\/li>\n\n\n\n<li><strong>Po\u0161ta a kalend\u00e1\u0159.<\/strong> Mail Station pot\u0159ebuje manu\u00e1ln\u00ed aktualizaci po instalaci bal\u00ed\u010dku PHP. Kalend\u00e1\u0159 Synology m\u00e1 vlastn\u00ed opravenou verzi 3.0.4-21435.<\/li>\n\n\n\n<li><strong>Vnit\u0159n\u00ed komponenta DSM.<\/strong> P\u0159\u00edtomno, ale extern\u011b nedostupn\u00e9, oprava odlo\u017eena na pozd\u011bj\u0161\u00ed verzi DSM, riziko hodnoceno Synology jako minim\u00e1ln\u00ed.<\/li>\n\n\n\n<li><strong>Kontejnery nejsou zakryt\u00e9.<\/strong> Runtime PHP uvnit\u0159 Container Manageru si m\u016f\u017eete sami opravit. \u017d\u00e1dn\u00e1 aktualizace bal\u00ed\u010dk\u016f se ho nedotkne, co\u017e je nej\u010dast\u011bj\u0161\u00ed d\u016fvod, pro\u010d si majitel\u00e9 NAS mysl\u00ed, \u017ee jsou hotovi, i kdy\u017e to tak nen\u00ed.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Pokud st\u00e1le pou\u017e\u00edv\u00e1te DSM star\u0161\u00ed verzi ne\u017e 7.2, Synology doporu\u010duje do\u010dasn\u011b deaktivovat dot\u010den\u00e9 bal\u00ed\u010dky, dokud nebude k dispozici opraven\u00e1 verze. Samotn\u00fd DSM 7.2 je v prohl\u00e1\u0161en\u00ed ozna\u010den jako ukon\u010den\u00fd, p\u0159esto\u017ee tyto aktualizace PHP obdr\u017eel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nejt\u011b\u017e\u0161\u00edm p\u0159\u00edpadem PHP2Shell je PHP 7.3 a star\u0161\u00ed. Synology neoprav\u00ed 7.3, proto\u017ee v\u011btev je na konci sv\u00e9 \u017eivotnosti a upstream pro 7.3 a star\u0161\u00ed verze nepublikoval v\u016fbec nic. Linuxov\u00e9 distribuce dodaly backporty pro n\u011bkter\u00e9 star\u00e9 streamy, ale PHP bal\u00ed\u010dek Synology nen\u00ed distribu\u010dn\u00edm bal\u00ed\u010dkem. Pokud web pot\u0159ebuje ke spu\u0161t\u011bn\u00ed 7.3 nebo 5.6, \u017e\u00e1dn\u00e1 z\u00e1plata se nekon\u00e1 a poctiv\u00fdmi mo\u017enostmi jsou p\u0159esunout web do podporovan\u00e9 v\u011btve, um\u00edstit ho za WAF nebo ho odstranit z ve\u0159ejn\u00e9ho internetu.<\/p>\n\n\n\n<h2 id=\"how-container-site-owners-handle-php2shell\" class=\"wp-block-heading\">Jak vlastn\u00edci kontejnerov\u00fdch web\u016f pracuj\u00ed s PHP2Shell<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">P\u011bt z na\u0161ich \u0161esti web\u016f pou\u017e\u00edv\u00e1 WordPress v Dockeru m\u00edsto Web Stationu a pr\u00e1v\u011b v tom se PHP2Shell st\u00e1v\u00e1 zaj\u00edmav\u00fdm, proto\u017ee Centrum bal\u00ed\u010dk\u016f v\u00e1m s t\u00edm nem\u016f\u017ee pomoci. B\u011bhov\u00e9 prost\u0159ed\u00ed je to, co obraz obsahuje, a jeho op\u011btovn\u00e9 sestaven\u00ed nen\u00ed tot\u00e9\u017e co jeho aktualizace.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Chyba PHP2Shell, na kterou jsme narazili jako prvn\u00ed a kter\u00e1 s nejv\u011bt\u0161\u00ed pravd\u011bpodobnost\u00ed postihne i ostatn\u00ed, spo\u010d\u00edv\u00e1 v tom, \u017ee p\u0159i p\u0159estavb\u011b vlastn\u00edho obrazu se znovu pou\u017e\u00edv\u00e1 z\u00e1kladn\u00ed vrstva z mezipam\u011bti. Odepnut\u00fd objekt <code>Z<\/code> \u0160t\u00edtek neznamen\u00e1 \u010derstv\u00fd. Jeden z na\u0161ich obraz\u016f byl znovu sestaven p\u0159ed \u010dty\u0159mi dny a st\u00e1le obsahoval PHP sestaven\u00ed z \u010dervence 2025, v\u00edce ne\u017e rok po bezpe\u010dnostn\u00edch oprav\u00e1ch, proto\u017ee nic nedonutilo Docker znovu st\u00e1hnout z\u00e1kladnu.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># \u0160patn\u011b: ti\u0161e znovu pou\u017eije jakoukoli z\u00e1kladn\u00ed vrstvu ulo\u017eenou lok\u00e1ln\u011b v mezipam\u011bti docker build -t mysite . # Spr\u00e1vn\u011b: v\u017edy znovu na\u010dt\u011bte z\u00e1kladn\u00ed obr\u00e1zek docker build --pull -t mysite . # Pak vyvolejte pouze slu\u017ebu, kterou m\u00e1te na mysli, bez spou\u0161t\u011bn\u00ed dormantn\u00edch sourozenc\u016f docker compose up -d --no-deps wordpress # A ov\u011b\u0159te to, na \u010dem skute\u010dn\u011b z\u00e1le\u017e\u00ed docker exec wordpress php -v<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Druh\u00e9 selh\u00e1n\u00ed PHP2Shell je hor\u0161\u00ed, proto\u017ee hl\u00e1s\u00ed \u00fasp\u011bch. Propojen\u00ed v\u00fdstupu sestaven\u00ed p\u0159es <code>ocas<\/code> skr\u00fdv\u00e1 selh\u00e1n\u00ed sestaven\u00ed, proto\u017ee v\u00fdstupn\u00ed k\u00f3d pipeline pat\u0159\u00ed k posledn\u00edmu p\u0159\u00edkazu v n\u011bm a <code>sada -e<\/code> nikdy se nespust\u00ed. Krok kompozice pot\u00e9 znovu vytvo\u0159\u00ed kontejner ze star\u00e9ho obrazu, vyp\u00ed\u0161e Started a vy odch\u00e1z\u00edte z nez\u00e1platovan\u00e9ho webu, kter\u00fd vypad\u00e1 jako \u010derstv\u011b nasazen\u00fd. Zkontrolujte v\u00fdsledek sestaven\u00ed samostatn\u011b a ov\u011b\u0159te ho pomoc\u00ed <code>php -v<\/code> pot\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dv\u011b men\u0161\u00ed pozn\u00e1mky. P\u0159ed op\u011btovn\u00fdm sestaven\u00edm obrazu ozna\u010dte star\u00fd obraz tagy, proto\u017ee obraz si sv\u016fj tag zachov\u00e1 a poskytne v\u00e1m bezplatn\u00fd bod pro vr\u00e1cen\u00ed zp\u011bt, kter\u00fd je mnohem levn\u011bj\u0161\u00ed ne\u017e snapshot. A neo\u010dek\u00e1vejte, \u017ee vylep\u0161en\u00ed obrazu aktualizuje aplikaci: ofici\u00e1ln\u00ed vstupn\u00ed bod obrazu WordPressu kop\u00edruje z\u00e1kladn\u00ed soubory pouze tehdy, kdy\u017e je ko\u0159enov\u00fd adres\u00e1\u0159 dokumentu pr\u00e1zdn\u00fd, tak\u017ee op\u011btovn\u00e9 vytvo\u0159en\u00ed kontejneru na nov\u011bj\u0161\u00edm obrazu ponech\u00e1 existuj\u00edc\u00ed instalaci p\u0159esn\u011b tam, kde byla. To jsme si ov\u011b\u0159ili na testovac\u00ed kopii p\u0159ed spu\u0161t\u011bn\u00edm produk\u010dn\u00ed verze a verze WordPressu se nep\u0159esunula.<\/p>\n\n\n\n<h2 id=\"why-disabling-upload-progress-only-covers-half\" class=\"wp-block-heading\">Pro\u010d zak\u00e1z\u00e1n\u00ed session.upload_progress pokr\u00fdv\u00e1 pouze polovinu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Zm\u00edrn\u011bn\u00ed PHP2Shell, kter\u00e9 se pou\u017e\u00edv\u00e1 pro po\u010d\u00edta\u010de, na kter\u00e9 nelze nainstalovat z\u00e1platy, spo\u010d\u00edv\u00e1 v nastaven\u00ed <code>session.upload_progress.enabled = 0<\/code>, a v DSM, kter\u00fd se nach\u00e1z\u00ed ve Web Station v Nastaven\u00ed skriptovac\u00edho jazyka, na kart\u011b J\u00e1dro v profilu PHP. Stoj\u00ed to za to. Nen\u00ed to oprava a na mezer\u011b z\u00e1le\u017e\u00ed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cesta pro upload-progress relace je pouze jednou z mo\u017enost\u00ed. Varianta memory-disclosure je dosa\u017eena b\u011b\u017en\u00fdm zpracov\u00e1n\u00edm v\u00edced\u00edln\u00fdch po\u017eadavk\u016f a v\u016fbec nevy\u017eaduje funkci session, tak\u017ee vypnut\u00ed t\u00e9to funkce ponech\u00e1v\u00e1 tuto cestu otev\u0159enou. Projekt PHP p\u0159\u00edmo uvedl, \u017ee neexistuj\u00ed \u017e\u00e1dn\u00e1 \u00fapln\u00e1 zm\u00edrn\u011bn\u00ed a \u017ee aktualizace je jedin\u00fdm bezpe\u010dn\u00fdm \u0159e\u0161en\u00edm. Imunify360 uv\u00e1d\u00ed, \u017ee \u017e\u00e1dn\u00e9 pravidlo v sou\u010dasn\u00e9 dob\u011b neblokuje cestu CVE-2026-109618 z d\u016fvodu nedostatku pam\u011bti, a Elastic poznamen\u00e1v\u00e1, \u017ee nastaven\u00ed upload-progress uzav\u00edr\u00e1 potvrzen\u00e9 cesty session, ale ne ka\u017edou variantu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tak\u00e9 uvid\u00edte <code>limit_memory = -1<\/code> navr\u017eeno na z\u00e1klad\u011b logiky, \u017ee k chyb\u011b se dos\u00e1hne v d\u016fsledku nedostatku pam\u011bti. Berte to jako obchod, ne jako v\u00fdhru. Odstran\u011bn\u00ed limitu na ve\u0159ejn\u00e9m webov\u00e9m serveru zm\u011bn\u00ed jeden re\u017eim selh\u00e1n\u00ed na jin\u00fd a na NAS se sd\u00edlen\u00fdm rozpo\u010dtem pam\u011bti to vyzve fond pracovn\u00edch proces\u016f k vy\u010derp\u00e1n\u00ed cel\u00e9ho po\u010d\u00edta\u010de.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Filtrov\u00e1n\u00ed na okraj\u00edch je vrstva PHP2Shell, kter\u00e1 skute\u010dn\u011b n\u011bco p\u0159id\u00e1v\u00e1, proto\u017ee vid\u00ed de\u0161ifrovan\u00fd provoz, zat\u00edmco v\u00e1\u0161 router ne. Cloudflare nasadil ochranu pomoc\u00ed spravovan\u00fdch pravidel pro PHP2Shell, AWS p\u0159idal pokryt\u00ed CVE-2026-109619 ve verzi 2.3 sv\u00e9 skupiny spravovan\u00fdch pravidel PHP a Azure Front Door dodal pravidlo 99006001, kter\u00e9 je ve v\u00fdchoz\u00edm nastaven\u00ed zak\u00e1z\u00e1no. Pravidla pro komunitn\u00ed Snort a Suricata existuj\u00ed na GitHubu, ale ofici\u00e1ln\u00ed sady pravidel pro Snort a Emerging Threats v dob\u011b psan\u00ed tohoto \u010dl\u00e1nku nic nepublikovaly, tak\u017ee funkce prevence naru\u0161en\u00ed NAS v\u00e1s zde nezachr\u00e1n\u00ed. Stejn\u011b nem\u016f\u017ee \u010d\u00edst uvnit\u0159 TLS.<\/p>\n\n\n\n<h2 id=\"which-nas-vendor-actually-shipped-a-fix\" class=\"wp-block-heading\">Kter\u00fd dodavatel NAS skute\u010dn\u011b dodal opravu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Toto je \u010d\u00e1st p\u0159\u00edb\u011bhu PHP2Shell, kter\u00e1 by m\u011bla ovlivnit va\u0161e n\u00e1kupy. Upstream PHP byl vyd\u00e1n 21. \u0159\u00edjna. Zde je p\u0159ehled \u010dty\u0159 hlavn\u00edch dodavatel\u016f NAS pro spot\u0159ebitele a prosumery, kter\u00e9 si vedly n\u00e1sleduj\u00edc\u00ed den, a to z jejich vlastn\u00edch poradensk\u00fdch str\u00e1nek, nikoli z report\u00e1\u017e\u00ed.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Prodejce<\/th><th>Poradn\u00ed<\/th><th>Postaven\u00ed<\/th><th>Opraven\u00e9 verze byly publikov\u00e1ny<\/th><\/tr><\/thead><tbody><tr><td><strong>Synology<\/strong><\/td><td>Synology-SA-26:14, 22. \u0159\u00edjna 2026<\/td><td><strong>Vy\u0159e\u0161eno<\/strong><\/td><td>Ano. Ka\u017ed\u00e1 pobo\u010dka od PHP 7.4 do 8.4, plus Kalend\u00e1\u0159 a Po\u0161tovn\u00ed stanice.<\/td><\/tr><tr><td>QNAP<\/td><td>QSA-26-18, 22. \u0159\u00edjna 2026<\/td><td>Oprava<\/td><td>Ne. V ka\u017ed\u00e9m \u0159\u00e1dku je naps\u00e1no Bude ozn\u00e1meno pozd\u011bji.<\/td><\/tr><tr><td>ASUSTOR<\/td><td>Ukon\u010den\u00ed podpory star\u0161\u00edho PHP, 22. \u0159\u00edjna 2026<\/td><td>D\u016fchod, ne z\u00e1plata<\/td><td>Ne. PHP 7, 7.3, 7.4 a 8.1 byly odstran\u011bny z App Central.<\/td><\/tr><tr><td>UGREENS<\/td><td>\u017d\u00e1dn\u00e9 nenalezeno<\/td><td>Nezn\u00e1m\u00fd<\/td><td>Pro UGOS Pro nebyl nalezen \u017e\u00e1dn\u00fd doporu\u010duj\u00edc\u00ed servis.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ve stejn\u00fd den, kdy bylo ozn\u00e1men\u00ed zve\u0159ejn\u011bno, Synology zve\u0159ejnil kompletn\u00ed tabulku verz\u00ed PHP2Shell a ozna\u010dil jej jako Vy\u0159e\u0161eno. Vlastn\u00edk DSM, kter\u00fd si jej p\u0159e\u010detl, m\u011bl odpoledne co d\u011blat: otev\u0159\u00edt Centrum bal\u00ed\u010dk\u016f, kliknout na Aktualizovat a ov\u011b\u0159it. To je cel\u00e1 cesta k n\u00e1prav\u011b a proto byly na\u0161e po\u010d\u00edta\u010de Web Station dokon\u010deny b\u011bhem n\u011bkolika minut, nikoli dn\u016f.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"852\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced.webp\" alt=\"Ozn\u00e1men\u00ed QNAP QSA-26-18 s uveden\u00edm stavu \u201eOprava\u201c a \u201eBude ozn\u00e1meno\u201c v ka\u017ed\u00e9m \u0159\u00e1dku opraven\u00e9 verze.\" class=\"wp-image-22081\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced-300x183.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced-1024x623.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced-768x467.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced-18x12.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced-600x365.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced-400x243.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-qnap-to-be-announced-1000x609.webp 1000w\" \/><figcaption class=\"wp-element-caption\">QNAP QSA-26-18: stav Oprava a ka\u017ed\u00e1 opraven\u00e1 verze bude teprve ozn\u00e1mena.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Spole\u010dnost QNAP zve\u0159ejnila ve stejn\u00fd den seznam produkt\u016f, kter\u00fdch se probl\u00e9m t\u00fdk\u00e1, v\u010detn\u011b QTS 6.1.0, QTS 5.2.11 a star\u0161\u00edch verz\u00ed, QuTS hero h6.1.0, h6.0.x a h5.2.11 a star\u0161\u00edch verz\u00ed, QuTScloud c5.2.9 a star\u0161\u00edch verz\u00ed, Note Station 3, QNE ADRA, QVR Surveillance na modelech ARM32 a TVR OS. V\u0161echny tyto produkty vykazuj\u00ed stav \u201eOprava\u201c bez opraven\u00e9 verze. Proto\u017ee b\u011bhov\u00e9 prost\u0159ed\u00ed PHP je sou\u010d\u00e1st\u00ed webov\u00fdch komponent QTS, nen\u00ed t\u0159eba aktualizovat \u017e\u00e1dn\u00fd bal\u00ed\u010dek, tak\u017ee n\u00e1prava mus\u00ed b\u00fdt dod\u00e1na ve form\u011b firmwaru.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Spole\u010dnost QNAP mezit\u00edm ob\u011btem PHP2Shell nab\u00edz\u00ed seznam opat\u0159en\u00ed, kter\u00e1 stoj\u00ed za to si pe\u010dliv\u011b p\u0159e\u010d\u00edst, proto\u017ee se v nich po\u017eaduje: zak\u00e1zat p\u0159esm\u011brov\u00e1n\u00ed port\u016f routeru a UPnP, zru\u0161it publikov\u00e1n\u00ed slu\u017eeb myQNAPcloud, p\u0159esunout vzd\u00e1len\u00fd p\u0159\u00edstup za VPN, omezit porty pro spr\u00e1vu na d\u016fv\u011bryhodn\u00e9 pods\u00edt\u011b, zastavit aplikace zalo\u017een\u00e9 na PHP, kter\u00e9 nepot\u0159ebujete, zak\u00e1zat vestav\u011bn\u00fd webov\u00fd server, pokud se nepou\u017e\u00edv\u00e1, a auditovat QuLog Center, zda nevykazuje zn\u00e1mky kompromitace. To je rozumn\u00e1 rada pro neinstalovan\u00e9 za\u0159\u00edzen\u00ed. Pro ka\u017ed\u00e9ho, kdo hostuje ve\u0159ejn\u00fd web, je to tak\u00e9 \u017e\u00e1dost o jeho vypnut\u00ed.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"814\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement.webp\" alt=\"Ozn\u00e1men\u00ed o ukon\u010den\u00ed podpory star\u0161\u00ed verze PHP od ASUSTORu ze dne 22. 10. 2026, kter\u00fdm byly odstran\u011bny verze PHP 7, 7.3, 7.4 a 8.1.\" class=\"wp-image-22082\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement-300x174.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement-1024x595.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement-768x447.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement-18x10.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement-600x349.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement-400x233.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/php2shell-asustor-retirement-1000x581.webp 1000w\" \/><figcaption class=\"wp-element-caption\">ASUSTOR reagoval na PHP2Shell t\u00edm, \u017ee nam\u00edsto aktualizace star\u0161\u00ed verze PHP ukon\u010dil jej\u00ed pou\u017e\u00edv\u00e1n\u00ed.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Spole\u010dnost ASUSTOR zvolila t\u0159et\u00ed cestu. V ozn\u00e1men\u00ed ze dne 22. \u0159\u00edjna s n\u00e1zvem \u201eOzn\u00e1men\u00ed o ukon\u010den\u00ed podpory star\u0161\u00edch verz\u00ed PHP\u201c se s okam\u017eitou platnost\u00ed odstra\u0148uj\u00ed PHP 7, PHP 7.3, PHP 7.4 a PHP 8.1 z App Central, doporu\u010duje z\u00e1lohovat d\u016fle\u017eit\u00e1 data a majitel\u016fm \u0159\u00edk\u00e1, aby od nyn\u011bj\u0161ka pou\u017e\u00edvali pouze PHP 8.3 nebo 8.4. Toto zd\u016fvodn\u011bn\u00ed je obhajiteln\u00e9, proto\u017ee upstream aktualizuje pouze verzi 8.2 a nov\u011bj\u0161\u00ed. Pro majitele, kter\u00fd provozuje starou PHP aplikaci, to znamen\u00e1, \u017ee b\u011bhov\u00e9 prost\u0159ed\u00ed z \u00falo\u017ei\u0161t\u011b zmiz\u00ed, m\u00edsto aby bylo opraveno, a ASUSTOR neuv\u00e1d\u00ed, \u017ee byla odesl\u00e1na opraven\u00e1 verze 8.3 nebo 8.4. V\u0161imn\u011bte si kontrastu s Synology, kter\u00fd zve\u0159ejnil opravenou verzi 7.4 pod \u010d\u00edslem 7.4.33-0131 p\u0159esn\u011b pro ty u\u017eivatele, o migraci kter\u00fdch ASUSTOR \u017e\u00e1d\u00e1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">V p\u0159\u00edpad\u011b UGREEN se n\u00e1m nepoda\u0159ilo naj\u00edt \u017e\u00e1dn\u00e9 doporu\u010den\u00ed PHP2Shell pro UGOS Pro. Absence ve\u0159ejn\u00e9ho prohl\u00e1\u0161en\u00ed nen\u00ed d\u016fkazem, \u017ee je produkt zraniteln\u00fd, a UGOS Pro jednodu\u0161e nemus\u00ed dod\u00e1vat webov\u00fd b\u011bhov\u00fd modul PHP. Pokud jste v\u0161ak vlastn\u00edkem, ml\u010den\u00ed nen\u00ed odpov\u011bd\u00ed, na kterou m\u016f\u017eete reagovat, a to je samo o sob\u011b druh odhalen\u00ed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nic z toho ned\u011bl\u00e1 z Synology dokonal\u00fd syst\u00e9m. Neoprav\u00ed PHP 7.3, ozna\u010d\u00ed DSM 7.2 jako ukon\u010den\u00fd a jeho vlastn\u00ed intern\u00ed PHP komponenta je st\u00e1le napl\u00e1nov\u00e1na, nikoli opravena. Jde o u\u017e\u0161\u00ed a u\u017eite\u010dn\u011bj\u0161\u00ed argument ne\u017e argument zna\u010dky: v den, kdy se v PHP enginu objevila chyba umo\u017e\u0148uj\u00edc\u00ed vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du p\u0159ed autorizac\u00ed, jeden dodavatel prom\u011bnil opravu v tla\u010d\u00edtko v Centru bal\u00ed\u010dk\u016f a ostatn\u00ed z n\u00ed ud\u011blali \u010dekac\u00ed hru.<\/p>\n\n\n\n<h2 id=\"where-to-find-more-official-resources\" class=\"wp-block-heading\">Kde naj\u00edt dal\u0161\u00ed ofici\u00e1ln\u00ed zdroje<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell je v dob\u011b psan\u00ed tohoto \u010dl\u00e1nku dva dny star\u00fd a situace se st\u00e1le m\u011bn\u00ed, proto se rad\u011bji \u0159i\u010fte prim\u00e1rn\u00edmi zdroji ne\u017e shrnut\u00edmi. Zat\u00edm neexistuje \u017e\u00e1dn\u00e9 ofici\u00e1ln\u00ed video zpravodajstv\u00ed od \u017e\u00e1dn\u00e9ho z dodavatel\u016f, tak\u017ee n\u00ed\u017ee uveden\u00fd seznam je sp\u00ed\u0161e dokumentac\u00ed ne\u017e n\u00e1vodem.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_14\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:14<\/a> je sm\u011brodatn\u00e1 tabulka verz\u00ed. P\u0159ed aktualizac\u00ed ji znovu zkontrolujte, proto\u017ee doporu\u010den\u00ed se reviduj\u00ed.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/php2shell\/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities\" target=\"_blank\" rel=\"noreferrer noopener\">Prohl\u00e1\u0161en\u00ed Synology PSIRT<\/a> uv\u00e1d\u00ed dot\u010den\u00e9 bal\u00ed\u010dky a vysv\u011btluje intern\u00ed komponentu DSM a v\u00fdjimku Mail Station.<\/li>\n\n\n\n<li>Na doporu\u010den\u00ed GitHubu GHSA-w8hw-w9fx-j79w a GHSA-6wmf-4rv5-p3rp odkazujeme z doporu\u010den\u00ed Synology a popisujeme chov\u00e1n\u00ed enginu, nikoli balen\u00ed od dodavatele.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.qnap.com\/en\/security-advisory\/qsa-26-18\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">QNAP QSA-26-18<\/a> zde se zobraz\u00ed opraven\u00e1 verze firmwaru, pokud pou\u017e\u00edv\u00e1te QTS nebo QuTS hero. Je to str\u00e1nka, kterou je t\u0159eba sledovat, ne \u010dl\u00e1nek s novinkami.<\/li>\n\n\n\n<li>Va\u0161e vlastn\u00ed Centrum bal\u00ed\u010dk\u016f je posledn\u00edm slovem o tom, co je nainstalov\u00e1no. Informa\u010dn\u00ed panel v\u00e1m sd\u011bl\u00ed c\u00edlovou sestavu, dla\u017edice v\u00e1m sd\u011bl\u00ed, co skute\u010dn\u011b m\u00e1te, a pouze <code>php -v<\/code> \u0159\u00edk\u00e1 v\u00e1m, co b\u011b\u017e\u00ed.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Informace o spou\u0161t\u011bn\u00ed ve\u0159ejn\u00fdch web\u016f na virtu\u00e1ln\u00edch po\u010d\u00edta\u010d\u00edch Synology naleznete v na\u0161em n\u00e1vodu na <a href=\"https:\/\/synopower.club\/cs\/synology-vdsm-docker-migration\/\">p\u0159esouv\u00e1n\u00ed Docker stacku mezi hosty VDSM<\/a> Zahrnuje n\u00e1vyky pro vytv\u00e1\u0159en\u00ed sn\u00edmk\u016f a vr\u00e1cen\u00ed zp\u011bt, kter\u00e9 umo\u017enily p\u0159e\u017e\u00edt tuto nouzovou situaci.<\/p>\n\n\n\n<h2 id=\"php2shell-limits-and-security-notes\" class=\"wp-block-heading\">Omezen\u00ed a bezpe\u010dnostn\u00ed pozn\u00e1mky PHP2Shellu<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Oprava PHP2Shellu je v DSM p\u0159\u00edmo\u010dar\u00e1 a jinde zav\u00e1d\u011bj\u00edc\u00ed, tak\u017ee ne\u017e pr\u00e1ci prohl\u00e1s\u00edte za dokon\u010denou, je vhodn\u00e9 jasn\u011b uv\u00e9st n\u011bkolik omezen\u00ed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Aktualizace bal\u00ed\u010dku PHP2Shell nen\u00ed audit webu. Aktualizace PHP od dan\u00e9ho okam\u017eiku uzav\u0159e mezeru, ale pokud bylo za\u0159\u00edzen\u00ed dostupn\u00e9 z internetu mezi 20. a 22. \u0159\u00edjnem, bylo dostupn\u00e9 i v dob\u011b, kdy byl funk\u010dn\u00ed exploit ve\u0159ejn\u011b dostupn\u00fd. Zkontrolujte protokoly, zda neobsahuj\u00ed neo\u010dek\u00e1van\u00fd POST svazek, vyhledejte soubory, kter\u00e9 se objevily v zapisovateln\u00fdch adres\u00e1\u0159\u00edch, a rotujte ve\u0161ker\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje, kter\u00e9 mohl m\u00edt PHP pracovn\u00edk. Varianta s prozrazen\u00edm pam\u011bti \u010din\u00ed z rotace p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f rozumn\u00e9 opat\u0159en\u00ed, nikoli paranoiu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ov\u011b\u0159en\u00ed PHP2Shellu se mus\u00ed zam\u011b\u0159it na spu\u0161t\u011bn\u00fd interpret. Dashboardy, protokoly sestaven\u00ed a hlavi\u010dky odpov\u011bd\u00ed n\u00e1s v tomto kole alespo\u0148 jednou zklamaly. CDN m\u016f\u017ee odstranit hlavi\u010dku, kter\u00e1 by v\u00e1m sd\u011blila verzi, sestaven\u00ed m\u016f\u017ee hl\u00e1sit \u00fasp\u011bch p\u0159i op\u011btovn\u00e9m pou\u017eit\u00ed vrstvy v mezipam\u011bti a dla\u017edice bal\u00ed\u010dku m\u016f\u017ee zobrazovat aktu\u00e1ln\u00ed verzi, zat\u00edmco star\u00fd worker st\u00e1le obsluhuje. <code>php -v<\/code> uvnit\u0159 v\u011bci, kter\u00e1 obsluhuje po\u017eadavky, se to urovn\u00e1.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kontejnery nejsou zahrnuty v \u017e\u00e1dn\u00e9m doporu\u010den\u00ed PHP2Shell od dodavatele. Toto je t\u0159eba zopakovat, proto\u017ee se jedn\u00e1 o nej\u010dast\u011bj\u0161\u00ed fale\u0161n\u00fd pocit bezpe\u010d\u00ed na NAS. Pokud v\u00e1\u0161 web b\u011b\u017e\u00ed ve Spr\u00e1vci kontejner\u016f, Centrum bal\u00ed\u010dk\u016f, kter\u00e9 hl\u00e1s\u00ed v\u0161e aktu\u00e1ln\u00ed, v\u00e1m o va\u0161em webu nic ne\u0159ekne. Tot\u00e9\u017e plat\u00ed pro jakoukoli aplikaci t\u0159et\u00ed strany, kter\u00e1 m\u00e1 sv\u016fj vlastn\u00ed b\u011bhov\u00fd modul.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zm\u00edrn\u011bn\u00ed konfigurace je z\u00e1m\u011brn\u011b jen \u010d\u00e1ste\u010dn\u00e9. Zak\u00e1z\u00e1n\u00ed pr\u016fb\u011bhu nahr\u00e1v\u00e1n\u00ed relac\u00ed pom\u00e1h\u00e1, odstran\u011bn\u00ed limitu pam\u011bti vym\u011b\u0148uje jedno riziko za jin\u00e9 a funkce prevence naru\u0161en\u00ed routeru nem\u016f\u017ee kontrolovat provoz TLS, kter\u00fd kon\u010d\u00ed jinde. Berte to v\u0161echno jako z\u00edskan\u00fd \u010das, zat\u00edmco za\u0159izujete skute\u010dnou z\u00e1platu, ne jako jej\u00ed n\u00e1hradu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Runtime prost\u0159ed\u00ed na konci sv\u00e9 \u017eivotnosti nemaj\u00ed \u017e\u00e1dnou cestu k PHP2Shell. PHP 7.3 a star\u0161\u00ed verze neobdr\u017eely nic od upstreamu ani od Synology. Pokud web skute\u010dn\u011b vy\u017eaduje nepodporovanou v\u011btev, m\u00e1te p\u0159ed sebou rozhodnut\u00ed migrace, izolace nebo sta\u017een\u00ed z ve\u0159ejn\u00e9ho internetu. \u010ctvrt\u00e1 mo\u017enost neexistuje a p\u0159edst\u00edr\u00e1n\u00ed opaku je zp\u016fsob, jak\u00fdm se star\u0161\u00ed web st\u00e1v\u00e1 cestou ke v\u0161emu ostatn\u00edmu na stejn\u00e9m serveru.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A kone\u010dn\u011b, sledujte sp\u00ed\u0161e doporu\u010den\u00ed ne\u017e zpravodajsk\u00fd cyklus. Synology ozna\u010deno SA-26:14 Vy\u0159e\u0161eno a jednou revidov\u00e1no do \u0161esti minut od zve\u0159ejn\u011bn\u00ed. Spole\u010dnost QNAP uvedla, \u017ee QSA-26-18 bude aktualizov\u00e1no, jakmile budou k dispozici opraven\u00e9 verze. Ob\u011b tyto str\u00e1nky se zm\u011bn\u00ed a \u010d\u00edsla verz\u00ed v tomto \u010dl\u00e1nku jsou ta, kter\u00e1 byla publikov\u00e1na 22. \u0159\u00edjna 2026.<\/p>\n\n\n\n<h2 id=\"references\" class=\"wp-block-heading\">Reference<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_14\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:14 Bezpe\u010dnostn\u00ed poradenstv\u00ed PHP2Shell<\/a>, publikov\u00e1no 22. \u0159\u00edjna 2026, stav Vy\u0159e\u0161eno, s opraven\u00fdmi verzemi pro PHP 7.4 a\u017e 8.4.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/php2shell\/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities\" target=\"_blank\" rel=\"noreferrer noopener\">Prohl\u00e1\u0161en\u00ed Synology o zranitelnostech PHP2Shell<\/a>, pozn\u00e1mka PSIRT s uveden\u00edm dot\u010den\u00fdch bal\u00ed\u010dk\u016f a pokryt\u00ed DSM.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.qnap.com\/en\/security-advisory\/qsa-26-18\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">QNAP QSA-26-18<\/a>, stav Oprava, dot\u010den\u00e9 produkty jsou uvedeny s opraven\u00fdmi verzemi Budou ozn\u00e1meny.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.asustor.com\/product\/status_detail?id=14\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Ozn\u00e1men\u00ed o ukon\u010den\u00ed podpory PHP verze ASUSTOR Legacy<\/a>, odstran\u011bn\u00ed PHP 7, 7.3, 7.4 a 8.1 z App Central.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">N\u00e1pov\u011bda Net Security k upstreamov\u00fdm verz\u00edm PHP2Shell<\/a>, zahrnuj\u00edc\u00ed PHP 8.5.12, 8.4.27, 8.3.36 a 8.2.35 a backporty pouze se zdrojov\u00fdm k\u00f3dem pro star\u0161\u00ed v\u011btve.<\/li>\n<\/ul>\n\n\n\n<h2 id=\"frequently-asked-questions\" class=\"wp-block-heading\">\u010casto kladen\u00e9 ot\u00e1zky<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list\">\n<div id=\"faq-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Je m\u016fj Synology NAS zraniteln\u00fd v\u016f\u010di PHP2Shell?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Pouze pokud b\u011b\u017e\u00ed bal\u00ed\u010dek z\u00e1visl\u00fd na PHP, kter\u00fd je dostupn\u00fd. Synology uv\u00e1d\u00ed Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station a WordPress. Intern\u00ed komponenta PHP v DSM je p\u0159\u00edtomna, ale Synology uv\u00e1d\u00ed, \u017ee nem\u00e1 \u017e\u00e1dnou odhalenou plochu pro \u00fatok a hodnot\u00ed riziko jako minim\u00e1ln\u00ed.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Jak mohu opravit PHP2Shell v DSM?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Otev\u0159ete Centrum bal\u00ed\u010dk\u016f, p\u0159ejd\u011bte do sekce Nainstalovan\u00e9 a aktualizujte v\u0161echny bal\u00ed\u010dky PHP, u kter\u00fdch je zobrazena mo\u017enost Aktualizace dostupn\u00e1. C\u00edlov\u00e9 sestaven\u00ed jsou 7.4.33-0131, 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051 a 8.4.27-0051. Z\u00e1visl\u00e9 bal\u00ed\u010dky se pot\u00e9 restartuj\u00ed, s v\u00fdjimkou Mail Station, kter\u00e1 vy\u017eaduje ru\u010dn\u00ed aktualizaci.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Oprav\u00ed to aktualizace WordPressu?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Ne. Chyba je v PHP enginu, ne ve WordPressu, tak\u017ee aktualizace j\u00e1dra, \u0161ablony a plugin\u016f nic nezm\u011bn\u00ed. Jedinou opravou je nov\u00e1 verze PHP. Toto je nej\u010dast\u011bj\u0161\u00ed nedorozum\u011bn\u00ed ohledn\u011b tohoto upozorn\u011bn\u00ed.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Je PHP 7.4 opravdu na Synology opraveno?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Ano. Synology publikoval verzi 7.4.33-0131, p\u0159esto\u017ee upstream PHP vydal pouze backport zdrojov\u00e9ho k\u00f3du bez \u010d\u00edslovan\u00e9ho vyd\u00e1n\u00ed pro danou v\u011btev. PHP 7.3 je jin\u00e9: Synology uv\u00e1d\u00ed, \u017ee nebude poskytnuta \u017e\u00e1dn\u00e1 oprava, proto\u017ee verze dos\u00e1hla konce \u017eivotnosti.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Ovliv\u0148uje PHP2Shell b\u011bh m\u00e9ho webu v Container Manageru?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>\u017d\u00e1dn\u00e1 aktualizace bal\u00ed\u010dku se toho nedotkne. Mus\u00edte znovu sestavit obraz pomoc\u00ed docker build \u2013pull, aby se z\u00e1kladn\u00ed vrstva znovu na\u010detla, spustit slu\u017ebu pomoc\u00ed up -d \u2013no-deps a pot\u00e9 potvrdit pomoc\u00ed php -v uvnit\u0159 kontejneru. V\u00fdstup sestaven\u00ed, kter\u00fd \u0159\u00edk\u00e1, \u017ee \u00fasp\u011bch nen\u00ed d\u016fkazem.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Zajist\u00ed mi vypnut\u00ed session.upload_progress bezpe\u010dnost?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Uzav\u00edr\u00e1 jednu cestu, ne v\u0161echny. Varianta s odhalen\u00edm pam\u011bti proch\u00e1z\u00ed b\u011b\u017en\u00fdm v\u00edced\u00edln\u00fdm zpracov\u00e1n\u00edm a nepot\u0159ebuje funkci relace. Projekt PHP uvedl, \u017ee neexistuj\u00ed \u017e\u00e1dn\u00e1 kompletn\u00ed zm\u00edrn\u011bn\u00ed a \u017ee aktualizace je jedin\u00fdm bezpe\u010dn\u00fdm \u0159e\u0161en\u00edm.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">M\u016f\u017ee prevence hrozeb na m\u00e9m routeru blokovat PHP2Shell?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Nem\u00e1 to smysl. Je to signaturn\u00ed engine, kter\u00fd nedok\u00e1\u017ee \u010d\u00edst uvnit\u0159 TLS, provoz mezi reverzn\u00ed proxy a zdrojem ve stejn\u00e9 pods\u00edti se k n\u011bmu nikdy nedostane a ofici\u00e1ln\u00ed sady pravidel Snort a Emerging Threats v dob\u011b psan\u00ed tohoto \u010dl\u00e1nku pro tyto CVE nepublikovaly nic.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Opravili u\u017e QNAP a ASUSTOR PHP2Shell?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Ne k 22. \u0159\u00edjnu 2026. Ozn\u00e1men\u00ed QNAP QSA-26-18 m\u00e1 stav Oprava, p\u0159i\u010dem\u017e ka\u017ed\u00e1 opraven\u00e1 verze je uvedena jako Bude ozn\u00e1meno, a ASUSTOR reagoval odstran\u011bn\u00edm star\u0161\u00edho PHP z App Central nam\u00edsto zve\u0159ejn\u011bn\u00ed opraven\u00e9 verze. Probl\u00e9m Synology-SA-26:14 byl ve stejn\u00fd den ozna\u010den jako Vy\u0159e\u0161eno s kompletn\u00ed tabulkou verz\u00ed.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>PHP2Shell is the name the industry settled on for CVE-2026-109618 and CVE-2026-109619, a pair of critical flaws in the PHP engine itself that allow unauthenticated remote code execution. Details leaked on 20 October 2026, a day before the coordinated disclosure, and the PHP project shipped emergency releases on 21 October. Because the bug lives in [&hellip;]<\/p>\n","protected":false},"author":0,"featured_media":22085,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","_xspeed_no_cache":false,"_xspeed_expiry_hours":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-22083","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-others"],"_links":{"self":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts\/22083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/comments?post=22083"}],"version-history":[{"count":1,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts\/22083\/revisions"}],"predecessor-version":[{"id":22084,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/posts\/22083\/revisions\/22084"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/media\/22085"}],"wp:attachment":[{"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/media?parent=22083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/categories?post=22083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/synopower.club\/cs\/wp-json\/wp\/v2\/tags?post=22083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}