{"id":22125,"date":"2026-10-25T07:58:10","date_gmt":"2026-10-24T23:58:10","guid":{"rendered":"https:\/\/synopower.club\/?post_type=docs&#038;p=22125"},"modified":"2026-10-25T08:04:28","modified_gmt":"2026-10-25T00:04:28","password":"","slug":"synology-threat-prevention-blind-spots","status":"publish","type":"docs","link":"https:\/\/synopower.club\/sv\/docs\/synology-threat-prevention-blind-spots\/","title":{"rendered":"Synology Threat Prevention: Vad det uppt\u00e4cker och vad det inte kan se"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Threat Prevention \u00e4r paketet de flesta v\u00e4ljer i samma \u00f6gonblick som de best\u00e4mmer sig f\u00f6r att vara v\u00e4rd f\u00f6r en webbplats p\u00e5 en Synology NAS. Det ligger p\u00e5 routern, har en sk\u00f6ldikon och dess instrumentpanel r\u00e4knar attacker i hundratal, s\u00e5 det ser ut som det som h\u00e5ller en offentlig webbplats s\u00e4ker. Vi k\u00f6r det p\u00e5 en RT6600ax framf\u00f6r varje maskin vi \u00e4ger, och det har varit v\u00e4rt att ha. F\u00f6r en egenv\u00e4rdad webbplats \u00e4r det dock n\u00e4stan helt irrelevant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Den h\u00e4r \"NAS Hosting 101\"-artikeln \u00f6ppnar v\u00e5r egen router, l\u00e4ser av en riktig vecka med h\u00e4ndelser fr\u00e5n den och visar exakt var Threat Prevention slutar kunna hj\u00e4lpa till, med PHP2Shell som exempel p\u00e5 en attack som Threat Prevention aldrig n\u00e5gonsin skulle se.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>SynoPower Club-punkt:<\/strong> Jag tillbringade l\u00e5ng tid p\u00e5 Synology-supporten, och fr\u00e5gan kom in konstant: vilken inst\u00e4llning ska jag sl\u00e5 p\u00e5 f\u00f6r att stoppa den h\u00e4r attacken? Det \u00e4r r\u00e4tt instinkt riktad mot fel l\u00e5da. Det som slutligen fick det att klicka f\u00f6r mig var att l\u00e4sa v\u00e5r egen h\u00e4ndelselista ist\u00e4llet f\u00f6r funktionssidan. Varje larm som v\u00e5r router har spelat in denna m\u00e5nad var en adress med ett d\u00e5ligt rykte, inte en beg\u00e4ran med en d\u00e5lig nyttolast. N\u00e4r du v\u00e4l har sett det slutar du be Threat Prevention att inspektera trafik som den h\u00e5ller i ett f\u00f6rseglat kuvert.<\/p>\n<\/blockquote>\n\n\n\n<h2 id=\"what-threat-prevention-actually-does-on-a-synology-router\" class=\"wp-block-heading\">Vad Threat Prevention faktiskt g\u00f6r p\u00e5 en Synology-router<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Threat Prevention \u00e4r ett system f\u00f6r intr\u00e5ngsuppt\u00e4ckt och intr\u00e5ngsskydd som bygger p\u00e5 Snort- och Suricata-arvet. Det l\u00e4ser paket n\u00e4r routern vidarebefordrar dem, j\u00e4mf\u00f6r dem med en signaturupps\u00e4ttning och spelar antingen in en varning eller sl\u00e4pper paketet. P\u00e5 v\u00e5r RT6600ax \u00e4r signaturfl\u00f6det ET Open, gratisversionen av reglerupps\u00e4ttningen Emerging Threats, som uppdateras dagligen kl. 09:00.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tre egenskaper f\u00f6ljer av den konstruktionen, och alla tre spelar st\u00f6rre roll \u00e4n n\u00e5gon kryssruta i gr\u00e4nssnittet:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It can only examine packets the router <strong>forwards<\/strong>. Traffic that never crosses the routing engine is not slow to inspect, it is invisible.<\/li>\n\n<li>It can only match on bytes it can <strong>read<\/strong>. Det finns ingen TLS-inspektion n\u00e5gonstans i Threat Prevention, s\u00e5 en krypterad nyttolast \u00e4r ogenomskinlig.<\/li>\n\n<li>It can only match signatures <strong>somebody else wrote<\/strong>. The interface exposes vendor classes to switch on and off, and nothing that accepts a rule you author yourself.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Inget av detta \u00e4r en defekt. Ett IPS vid n\u00e4tverksperimetern \u00e4r en rimlig och anv\u00e4ndbar sak att \u00e4ga. Misstaget \u00e4r att anta att perimetern \u00e4r d\u00e4r en webbplats attackeras.<\/p>\n\n\n\n<h2 id=\"threat-prevention-vs-a-web-application-firewall\" class=\"wp-block-heading\">Threat Prevention j\u00e4mf\u00f6rt med en webbapplikationsbrandv\u00e4gg<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Det tydligaste s\u00e4ttet att se klyftan \u00e4r att st\u00e4lla Threat Prevention bredvid en webbapplikationsbrandv\u00e4gg och fr\u00e5ga vad var och en h\u00e5ller i n\u00e4r den fattar sitt beslut. Threat Prevention h\u00e5ller i ett paket. En WAF h\u00e5ller i en dekrypterad HTTP-beg\u00e4ran.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Question<\/th><th>Router IPS<\/th><th>Reverse-proxy WAF<\/th><\/tr><\/thead><tbody><tr><td>Vart den l\u00f6per<\/td><td>On the routing path, before TLS ends<\/td><td>At the edge, after TLS ends<\/td><\/tr><tr><td>What it inspects<\/td><td>Packet headers and any cleartext bytes<\/td><td>Method, path, headers, cookies, body<\/td><\/tr><tr><td>HTTPS traffic<\/td><td>Opaque<\/td><td>Fully readable<\/td><\/tr><tr><td>Rules you can add<\/td><td>Vendor classes on or off<\/td><td>Your own expressions, plus managed rulesets<\/td><\/tr><tr><td>Same-subnet traffic<\/td><td>Never seen<\/td><td>Not applicable, it is upstream of everything<\/td><\/tr><tr><td>Typical catch<\/td><td>Reputation hits, scans, cleartext exploits, outbound command and control<\/td><td>Injection, traversal, known CVE request shapes, credential stuffing, bots<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Det \u00e4r inte konkurrerande produkter. De t\u00e4cker olika delar av samma resa, och en egenv\u00e4rdad webbplats beh\u00f6ver den senare betydligt mer \u00e4n den f\u00f6rra. Vi beh\u00e5ller b\u00e5da, och vi f\u00f6rv\u00e4ntar oss helt olika saker av dem.<\/p>\n\n\n\n<h2 id=\"reading-595-events-from-one-week-on-our-own-router\" class=\"wp-block-heading\">Att l\u00e4sa av 595 h\u00e4ndelser fr\u00e5n en vecka p\u00e5 v\u00e5r egen router<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">H\u00e4r \u00e4r \u00f6versiktssk\u00e4rmen i Threat Prevention f\u00f6r v\u00e5r produktionsrouter den 25 oktober 2026. Femhundranittiofem skadliga h\u00e4ndelser under sju dagar, varav 75 med h\u00f6g allvarlighetsgrad. Det ser ut som en mur som h\u00e5ller tillbaka en \u00f6versv\u00e4mning.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"eager\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp\" alt=\"\u00d6versikt \u00f6ver Synology Threat Prevention p\u00e5 en RT6600ax som visar 595 skadliga h\u00e4ndelser under sju dagar och en enhet med potentiella hot\" class=\"wp-image-22119\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-overview-595-events-1000x482.webp 1000w\"  fetchpriority=\"high\"\/><figcaption class=\"wp-element-caption\">Sju dagar p\u00e5 v\u00e5r egen RT6600ax. En enda enhet st\u00e5r f\u00f6r varje h\u00e4ndelse med h\u00f6g allvarlighetsgrad, och det \u00e4r e-postservern, inte webbv\u00e4rden.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Tv\u00e5 detaljer p\u00e5 den sk\u00e4rmen \u00e4r v\u00e4rda mer \u00e4n den \u00f6vergripande siffran. Den f\u00f6rsta \u00e4r att endast en enhet \u00f6verhuvudtaget visas under potentiella hot, och det \u00e4r REVERSE_MAIL, maskinen som terminerar TLS och k\u00f6r MailPlus. Den andra \u00e4r signaturdatumet bredvid den gr\u00f6na bocken. \u00d6ppna nu en enskild h\u00e4ndelse och l\u00e4s vad som faktiskt utl\u00f6stes.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp\" alt=\"En Threat Prevention-h\u00e4ndelsedetalj som visar en ET CINS-signatur f\u00f6r IP med d\u00e5ligt rykte med status Varning och en regeltext som endast matchar p\u00e5 IP-adresser\" class=\"wp-image-22120\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-event-ip-reputation-signature-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Signaturtexten avsl\u00f6jar allt. Den b\u00f6rjar med alert ip f\u00f6ljt av en lista med adresser, s\u00e5 ingenting i beg\u00e4ran granskades.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Klassificering Misc Attack, allvarlighetsgrad Medium, status Alert, signaturnamn ET CINS Active Threat Intelligence Poor Reputation IP group 24. \u00d6ppna regeltexten s\u00e5 b\u00f6rjar den med alert ip och sedan en l\u00e5ng lista med adresser. Det \u00e4r en sp\u00e4rrlistuppslagning. Ingen del av HTTP-beg\u00e4ran l\u00e4stes, eftersom ingen del av den kunde l\u00e4sas. Vi tog stickprov p\u00e5 h\u00e4ndelser mot ett annat m\u00e5l, v\u00e5r Virtual DSM-v\u00e4rd, och hittade samma regelklass med ett annat gruppnummer.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">S\u00e5 den \u00e4rliga sammanfattningen av en vecka \u00e4r denna: routern k\u00e4nde igen n\u00e5gra hundra anslutningar fr\u00e5n adresser som redan hade ett d\u00e5ligt rykte. Det \u00e4r genuint anv\u00e4ndbart. Det \u00e4r inte uppt\u00e4ckt av webbattacker, och ingen b\u00f6r l\u00e4sa siffran 595 som om den vore det.<\/p>\n\n\n\n<h2 id=\"how-to-audit-threat-prevention-in-4-steps\" class=\"wp-block-heading\">Hur du granskar Threat Prevention i 4 steg<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Innan du litar p\u00e5 Threat Prevention med n\u00e5got, \u00e4gna tio minuter \u00e5t att ta reda p\u00e5 vad det faktiskt g\u00f6r p\u00e5 ditt eget n\u00e4tverk. Varje steg nedan \u00e4r skrivskyddat och \u00e4ndrar ingenting.<\/p>\n\n\n<div id=\"rank-math-howto\" class=\"rank-math-block\" >\n<div class=\"rank-math-howto-description\">\n\n<\/div>\n\n<div class=\"rank-math-steps\">\n<div id=\"step-1\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">\u00d6ppna en h\u00e4ndelse och l\u00e4s signaturens br\u00f6dtext<\/h3>\n<div class=\"rank-math-step-content\"><p>G\u00e5 till Threat Prevention, sedan H\u00e4ndelser (Events), och klicka p\u00e5 valfri post. Titta f\u00f6rbi den f\u00e4rgade allvarlighetsbrickan till rutan Signaturregler. En regel som b\u00f6rjar med alert ip matchar enbart p\u00e5 adressrykte. En regel som inneh\u00e5ller content eller pcre matchar p\u00e5 nyttolast (payload). R\u00e4kna hur m\u00e5nga av varje du kan hitta i din egen lista innan du best\u00e4mmer dig f\u00f6r vad Threat Prevention skyddar.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-2\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Kontrollera vilka gr\u00e4nssnitt som \u00f6vervakas<\/h3>\n<div class=\"rank-math-step-content\"><p>\u00d6ppna Inst\u00e4llningar och l\u00e4s tabellen \u00d6vervakade gr\u00e4nssnitt. Endast de gr\u00e4nssnitt som \u00e4r ikryssade d\u00e4r inspekteras, och i en normal distribution \u00e4r dessa de som \u00e4r v\u00e4nda mot internet. Trafik mellan tv\u00e5 enheter p\u00e5 samma LAN-subn\u00e4t switchas snarare \u00e4n routas, s\u00e5 den n\u00e5r aldrig inspektionsmotorn och ingen inst\u00e4llning p\u00e5 den h\u00e4r sidan kan \u00e4ndra det.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-3\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Ta reda p\u00e5 vad som h\u00e4nder n\u00e4r routern \u00e4r upptagen<\/h3>\n<div class=\"rank-math-step-content\"><p>I samma panel, titta p\u00e5 standardl\u00e4get. Prioritet f\u00f6r n\u00e4tverksstabilitet inneb\u00e4r att n\u00e4r trafiken \u00f6verskrider vad motorn kan hantera sl\u00e4pps det \u00f6verskjutande igenom ofiltrerat. S\u00e4kerhetsprioritet inneb\u00e4r att det \u00f6verskjutande ist\u00e4llet kastas. Det ena valet \u00e4r fail-open och h\u00e5ller din linje uppe, det andra \u00e4r fail-closed och tar ner din linje. Best\u00e4m vilket alternativ du faktiskt vill ha.<\/p>\n<\/div>\n<\/div>\n<div id=\"step-4\" class=\"rank-math-step\">\n<h3 class=\"rank-math-step-title\">Try to add a rule of your own<\/h3>\n<div class=\"rank-math-step-content\"><p>Open Self-Defined Policy. You can change the action for a signature the vendor already ships, and you can scope it by source or destination address. There is no field anywhere that accepts a signature you wrote. If your threat is newer than your signature feed, this screen is where you discover you have no way to respond.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n\n\n\n<h2 id=\"where-it-genuinely-earns-its-place\" class=\"wp-block-heading\">D\u00e4r det verkligen f\u00f6rtj\u00e4nar sin plats<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Vi h\u00e5ller Threat Prevention aktiverat, och inte av skrockfullhet. Det finns fyra uppgifter det g\u00f6r som inget annat i v\u00e5r milj\u00f6 g\u00f6r.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Outbound command and control.<\/strong> This is the strongest case by far. A compromised device has to call home, that call has to leave through the router, and a good share of it is still either cleartext or aimed at a known address. Our router ships the Malware Command and Control Activity class with 3,450 of 3,498 rules enabled, and the Domain Observed Used for C2 class with 7,157 of 7,202.<\/li>\n\n<li><strong>Cleartext protocols from the internet.<\/strong> Our mail server answers on port 25, and SMTP is cleartext until STARTTLS. That is real inspectable traffic, and it is no accident that the mail host is the one device our events list keeps naming.<\/li>\n\n<li><strong>Scanning and reconnaissance.<\/strong> Port sweeps and fingerprinting are recognised by connection behaviour rather than by payload, so encryption does not hide them.<\/li>\n\n<li><strong>Visibility.<\/strong> A searchable log of who knocked and with what reputation is worth having, even when every entry is only a reputation hit. It is monitoring value, and it should be counted as monitoring value rather than as protection.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Vad dessa fyra har gemensamt \u00e4r att ingen av dem \u00e4r en attack mot en webbplats.<\/p>\n\n\n\n<h2 id=\"why-a-site-owner-asks-threat-prevention-for-the-wrong-thing\" class=\"wp-block-heading\">Varf\u00f6r en webbplats\u00e4gare ber Threat Prevention om fel sak<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">N\u00e4r du \u00e4r v\u00e4rd f\u00f6r en webbplats p\u00e5 en NAS inneh\u00e5ller s\u00f6kv\u00e4gen f\u00f6r beg\u00e4ran vanligtvis en omv\u00e4nd proxy. V\u00e5r ser ut s\u00e5 h\u00e4r, och formen \u00e4r vad som avg\u00f6r allt:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The visitor reaches <strong>Cloudflare<\/strong>, which answers most requests from cache and inspects the rest in cleartext.<\/li>\n\n<li>What is left crosses the <strong>router<\/strong>, d\u00e4r Threat Prevention ser en krypterad TLS-str\u00f6m och ingenting mer.<\/li>\n\n<li>De <strong>reverse proxy NAS<\/strong> terminates TLS and forwards plain HTTP to the machine that runs the site.<\/li>\n\n<li>That last hop is on the <strong>same subnet<\/strong>, so the frame goes through a switch and the router is not in the path.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">L\u00e4s de fyra raderna tillsammans och f\u00e4llan \u00e4r uppenbar. Det enda segmentet d\u00e4r beg\u00e4ran finns i l\u00e4sbar form \u00e4r det sista hoppet, och det \u00e4r det enda segment som routern inte kan observera. \u00d6verallt d\u00e4r routern kan observera \u00e4r beg\u00e4ran krypterad. Det finns ingen kryssruta som l\u00f6ser en s\u00e5dan mots\u00e4gelse, och Threat Prevention misslyckas inte n\u00e4r det f\u00f6rblir tyst. Det rapporterar korrekt om trafik som det strukturellt inte kan l\u00e4sa.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detta \u00e4r ocks\u00e5 anledningen till att det inte fungerar att rikta Threat Prevention mot en specifik webbplats. Paketet \u00e4r bundet till routergr\u00e4nssnitt, inte till v\u00e4rdnamn. Det har inget begrepp om vilken av dina webbplatser en anslutning tillh\u00f6r, eftersom det aldrig ser Host-headern.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp\" alt=\"Inst\u00e4llningar f\u00f6r Threat Prevention som visar \u00f6vervakade gr\u00e4nssnitt begr\u00e4nsade till internetanslutna portar, prioriterat l\u00e4ge f\u00f6r n\u00e4tverksstabilitet och k\u00e4llan f\u00f6r ET Open-signaturer\" class=\"wp-image-22121\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-settings-monitored-interfaces-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">\u00d6vervakade gr\u00e4nssnitt utg\u00f6r hela omfattningen f\u00f6r Threat Prevention. Notera standardl\u00e4get d\u00e4runder och signaturk\u00e4llan l\u00e4ngst ned.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"three-reasons-php2shell-was-invisible-at-the-router\" class=\"wp-block-heading\">Tre anledningar till att PHP2Shell var osynligt vid routern<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell, paret av s\u00e5rbarheter f\u00f6r fj\u00e4rrk\u00f6rning av kod f\u00f6re autentisering som sp\u00e5ras som CVE-2026-109618 och CVE-2026-109619, l\u00e4ckte den 20 oktober 2026 och korrigerades uppstr\u00f6ms dagen efter. Det \u00e4r precis den typ av sak folk hoppas att ett router-IPS ska f\u00e5nga upp, och det \u00e4r v\u00e4rt att vara specifik om varf\u00f6r det inte kunde g\u00f6ra det.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>F\u00f6r det f\u00f6rsta var trafiken krypterad p\u00e5 varje segment som routern \u00f6vervakar.<\/strong> The exploit lives in the HTTP request, and the HTTP request only exists in the clear after TLS has been terminated, which happens downstream of the router on a hop the router never carries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>F\u00f6r det andra finns det ingen Threat Prevention-signatur att sl\u00e5 p\u00e5.<\/strong> We checked again on 25 October 2026 and found no published Snort or Emerging Threats rule for either CVE. Our feed is ET Open, the free tier, which lags the commercial set, and the Self-Defined Policy screen accepts no rule of your own. So even an operator who knew precisely what to match for had nowhere to put it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp\" alt=\"Sk\u00e4rmen Egendefinierad princip (Self-Defined Policy) i Threat Prevention, tom, med endast Redigera och Ta bort tillg\u00e4ngliga och inget alternativ f\u00f6r att skapa en ny signatur\" class=\"wp-image-22123\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-self-defined-policy-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">Egendefinierad policy justerar \u00e5tg\u00e4rden f\u00f6r signaturer som leverant\u00f6ren redan levererar. Det finns inget f\u00e4lt d\u00e4r du kan ange en regel du har skrivit sj\u00e4lv.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>F\u00f6r det tredje, och mest fundamentalt, har denna attack ingen nyttolastform att matcha.<\/strong> The chain takes two requests. The first has to push PHP into exhausting its memory limit, which makes the engine abandon a request through a path that skips cleanup and leaves some global state behind. The second request is ordinary, and it is the one that reaches a stale pointer and turns into code execution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Den f\u00f6rsta beg\u00e4ran definieras av hur mycket minne den f\u00f6rbrukar, inte av n\u00e5gon sekvens av byte, och en stor uppladdning, en enorm JSON-textkropp, en djup matris och en l\u00e5ng str\u00e4ng i ett regulj\u00e4rt uttryck uppfyller alla kraven. Den andra inneh\u00e5ller inga skadliga byte alls. Ett IPS fattar beslut per paket och per fl\u00f6de. Det har ingen modell f\u00f6r en arbetsprocess som b\u00e4r ett kontaminerat tillst\u00e5nd fr\u00e5n en beg\u00e4ran till n\u00e4sta, vilket \u00e4r precis d\u00e4r den h\u00e4r buggen finns.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det s\u00e4tter ocks\u00e5 gr\u00e4nserna f\u00f6r den tillf\u00e4lliga \u00e5tg\u00e4rd som cirkulerade d\u00e5, vilken var att st\u00e4nga av session.upload_progress i PHP-konfigurationen. Det tar bort ett v\u00e4ldokumenterat s\u00e4tt att n\u00e5 det andra CVE:et, och p\u00e5 en maskin som du verkligen inte kan korrigera \u00e4r det b\u00e4ttre \u00e4n ingenting. Det \u00e4r ingen permanent l\u00f6sning: minnesutt\u00f6mning kan inte n\u00e5s enbart via den funktionen, och inst\u00e4llningen har ingen som helst inverkan p\u00e5 CVE-2026-109618. Vi anv\u00e4nde det som en n\u00f6dl\u00f6sning p\u00e5 exakt en v\u00e4rd och behandlade det som l\u00e5nad tid, inte som en slutgiltig l\u00f6sning. Den fullst\u00e4ndiga redog\u00f6relsen f\u00f6r hur vi korrigerade finns i v\u00e5r <a href=\"https:\/\/synopower.club\/sv\/synology-php2shell-emergency-patch\/\">PHP2Shell write-up<\/a>.<\/p>\n\n\n\n<h2 id=\"fail-open-by-design-and-the-day-it-cost-us-our-mail\" class=\"wp-block-heading\">Standardm\u00e4ssigt \u00f6ppen vid fel, och dagen d\u00e5 det kostade oss v\u00e5r e-post<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Det finns ytterligare en egenskap som \u00e4r v\u00e4rd att k\u00e4nna till innan du behandlar Threat Prevention som en s\u00e4kerhetskontroll du kan lita p\u00e5. Dess rekommenderade standardl\u00e4ge \u00e4r n\u00e4tverksstabilitetsprioriterat l\u00e4ge, och gr\u00e4nssnittet anger vad det inneb\u00e4r utan n\u00e5gra eufemismer: n\u00e4r trafiken \u00f6verskrider bearbetningskapaciteten f\u00f6rbig\u00e5s v\u00e4ntande paket utan filtrering. Alternativet, s\u00e4kerhetsprioriterat l\u00e4ge, sl\u00e4pper dem i st\u00e4llet och varnar f\u00f6r att anslutningen kommer att vara instabil tills problemet har l\u00f6sts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det \u00e4r en f\u00f6rnuftig standardinst\u00e4llning f\u00f6r en hemrouter. Det inneb\u00e4r dock att Threat Prevention \u00e4r som svagast i det \u00f6gonblick d\u00e5 du vill att det ska vara som starkast, eftersom en \u00f6verbelastning b\u00e5de \u00e4r det du vill ha filtrerat och det som \u00f6verskrider kapaciteten.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vi har ocks\u00e5 det andra fels\u00e4ttet dokumenterat. Den 2 augusti 2026 attackerade n\u00e5gon v\u00e5r omv\u00e4nda proxy 116 g\u00e5nger med ett exploit f\u00f6r en Windows PHP-CGI-bugg som inte alls kan fungera mot Linux. Threat Prevention sl\u00e4ppte tillr\u00e4ckligt med paket f\u00f6r att l\u00e5sa sitt eget tillst\u00e5nd och b\u00f6rjade sedan avvisa utg\u00e5ende trafik fr\u00e5n samma maskin som det var satt att f\u00f6rsvara. V\u00e5r e-postk\u00f6 stannade och symptomet s\u00e5g ut precis som ett DNS-fel. Omstart av routern l\u00f6ste det. Inget d\u00f6k upp i proxyns \u00e5tkomstlogg, eftersom ingenting n\u00e5gonsin n\u00e5dde proxyn. En attack som strukturellt var of\u00f6rm\u00f6gen att lyckas orsakade \u00e4nd\u00e5 ett avbrott f\u00f6r oss, via det verktyg som var avsett att stoppa den.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1400\" height=\"675\" sizes=\"auto, (max-width: 1400px) 100vw, 1400px\" src=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp\" alt=\"Klass- och signaturlistan i Threat Prevention med antal aktiverade per klass, inklusive Web Application Attack med 5 928 av 6 010 regler\" class=\"wp-image-22122\" srcset=\"https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list.webp 1400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-300x145.webp 300w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1024x494.webp 1024w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-768x370.webp 768w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-18x9.webp 18w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-600x289.webp 600w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-400x193.webp 400w, https:\/\/synopower.club\/wp-content\/uploads\/2026\/10\/synology-threat-prevention-class-signature-list-1000x482.webp 1000w\" \/><figcaption class=\"wp-element-caption\">V\u00e4xlar p\u00e5 klassniv\u00e5 med ett aktiverat antal till h\u00f6ger. Detta utg\u00f6r hela finjusteringsytan.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Titta p\u00e5 antalet aktiverade i den listan n\u00e4r du \u00e4nd\u00e5 \u00e4r d\u00e4r. Web Application Attack visar 5 928 av 6 010 regler aktiva, och f\u00f6rh\u00e5llandet \u00e4r liknande i de klasser vi bryr oss om. Att aktivera en klass aktiverar inte alla regler i den, och gr\u00e4nssnittet ger dig inget s\u00e4tt att se vilka av de \u00e5terst\u00e5ende du saknar.<\/p>\n\n\n\n<h2 id=\"put-a-proxy-in-front-then-lock-the-origin-to-it\" class=\"wp-block-heading\">Placera en proxy framf\u00f6r, l\u00e5s sedan ursprunget till den<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Om du tillhandah\u00e5ller en webbplats fr\u00e5n en NAS \u00e4r den kontroll som g\u00f6r jobbet som routern inte klarar av en reverse proxy-WAF. Vi anv\u00e4nder Cloudflare, och anledningen \u00e4r position snarare \u00e4n varum\u00e4rke: TLS termineras i kanten (edge), s\u00e5 hela f\u00f6rfr\u00e5gan \u00e4r l\u00e4sbar i det \u00f6gonblick beslutet fattas. Metod, s\u00f6kv\u00e4g, query, headers, cookies och body \u00e4r alla tillg\u00e4ngliga f\u00f6r en regel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Det \u00e4r d\u00e4rf\u00f6r PHP2Shell-skydden hamnade d\u00e4r och inte p\u00e5 routern. N\u00e4r dessa CVE:er uppt\u00e4cktes fick den hanterade regelupps\u00e4ttningen sju regler f\u00f6r paret inom tv\u00e5 dagar, och de var aktiva p\u00e5 alla fyra zoner vi k\u00f6r innan vi hade hunnit bygga om v\u00e5ra egna containrar. Ingen motsvarighet d\u00f6k n\u00e5gonsin upp i Threat Prevention-fl\u00f6det, och fem dagar senare finns det fortfarande ingen offentlig Snort- eller Emerging Threats-regel att installera.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">En varning som \u00e4r viktigare \u00e4n valet av leverant\u00f6r. En proxy framf\u00f6r hj\u00e4lper bara s\u00e5 l\u00e4nge den inte kan kringg\u00e5s. Om din ursprungsadress svarar det offentliga internet direkt kommer alla som uppt\u00e4cker den att f\u00f6rbig\u00e5 varje kantregel du har skrivit. Begr\u00e4nsa port 443 p\u00e5 ursprunget till proxyns n\u00e4tverksintervall, h\u00e4mta dessa intervall fr\u00e5n leverant\u00f6rens slutpunkt snarare \u00e4n att h\u00e5rdkoda dem, och verifiera l\u00e5sningen genom att beg\u00e4ra webbplatsen direkt fr\u00e5n dess adress. V\u00e5r ut\u00f6kade konfiguration, och de fyra lagren bakom denna, beskrivs i <a href=\"https:\/\/synopower.club\/sv\/docs\/synology-nas-security-public-website\/\">the five layers we run<\/a>.<\/p>\n\n\n\n<h2 id=\"threat-prevention-limits-and-security-notes\" class=\"wp-block-heading\">Begr\u00e4nsningar och s\u00e4kerhetsanteckningar f\u00f6r Threat Prevention<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Threat Prevention kr\u00e4ver extern lagring p\u00e5 routern och finns inte tillg\u00e4ngligt p\u00e5 alla modeller, s\u00e5 bekr\u00e4fta st\u00f6det f\u00f6r din h\u00e5rdvara innan du planerar utifr\u00e5n det. Motorn \u00e4r ocks\u00e5 det mest kr\u00e4vande din router k\u00f6r, och p\u00e5 en konsumentenhet \u00e4r det den komponent som \u00e4r mest ben\u00e4gen att bli flaskhalsen f\u00f6r genomstr\u00f6mningen. M\u00e4t f\u00f6re och efter i st\u00e4llet f\u00f6r att lita p\u00e5 marknadsf\u00f6ringssiffran.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Behandla varje siffra p\u00e5 \u00f6versiktssk\u00e4rmen som ett antal signaturtr\u00e4ffar, inte ett antal stoppade attacker. De tv\u00e5 skiljer sig \u00e5t i b\u00e5da riktningarna. En ryktesstr\u00e4ff mot en skanner som \u00e4nd\u00e5 inte skulle \u00e5stadkomma n\u00e5got bl\u00e5ser upp totalsumman, och en lugn vecka bevisar ingenting om den HTTPS-trafik som motorn inte kan l\u00e4sa.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I Threat Prevention spelar status lika stor roll som allvarlighetsgrad. \"Sl\u00e4pp h\u00f6griskpaket automatiskt\" agerar bara p\u00e5 den h\u00f6ga niv\u00e5n, s\u00e5 poster med medelh\u00f6g allvarlighetsgrad registreras och vidarebefordras. Ett gr\u00e4nssnitt som visar Alert talar om f\u00f6r dig att paketet levererades.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Signaturfl\u00f6det \u00e4r en leveranskedja. ET Open uppdateras enligt ett schema, ligger efter den kommersiella regelupps\u00e4ttningen och skickar kanske inte ut n\u00e5gonting alls f\u00f6r en s\u00e5rbarhet som \u00e4r flera dagar gammal. En instrumentpanel som rapporterar att databasen \u00e4r uppdaterad rapporterar att den matchar fl\u00f6det, inte att fl\u00f6det t\u00e4cker det som f\u00f6r n\u00e4rvarande utnyttjas.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Inget av detta ers\u00e4tter patchning. Varje lager som diskuteras h\u00e4r k\u00f6per tid f\u00f6r det som faktiskt t\u00e4pper till en s\u00e5rbarhet, vilket \u00e4r att uppdatera den drabbade programvaran. F\u00f6r PHP2Shell innebar det nya PHP-paket och ombyggda containrar, och ingen n\u00e4tverkskontroll kunde ers\u00e4tta det.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Slutligen, motst\u00e5 frestelsen att sl\u00e5 p\u00e5 varje klass efter att ha l\u00e4st ett s\u00e4kerhetsmeddelande. Klasser som Misc activity inneh\u00e5ller tusentals regler med l\u00e5gt v\u00e4rde som mestadels genererar brus och f\u00f6rbrukar samma kapacitet som de anv\u00e4ndbara klasserna beh\u00f6ver. En tyst, v\u00e4ljusterad h\u00e4ndelselista som du faktiskt l\u00e4ser sl\u00e5r en h\u00f6gljudd som du l\u00e4r dig att ignorera.<\/p>\n\n\n\n<h2 id=\"frequently-asked-questions\" class=\"wp-block-heading\">Vanliga fr\u00e5gor<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list\">\n<div id=\"faq-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Skyddar Threat Prevention en webbplats som \u00e4r v\u00e4rd p\u00e5 min NAS?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Knappast, och inte p\u00e5 det s\u00e4tt som namnet antyder. En webbplats levereras \u00f6ver HTTPS, och Threat Prevention utf\u00f6r ingen TLS-inspektion, s\u00e5 beg\u00e4ran \u00e4r ogenomskinlig varhelst routern kan se den. I en typisk installation blir beg\u00e4ran l\u00e4sbar f\u00f6rst efter att en omv\u00e4nd proxy (reverse proxy) terminerar TLS, och det hoppet \u00e4r vanligtvis p\u00e5 samma undern\u00e4t, s\u00e5 det v\u00e4xlas snarare \u00e4n dirigeras och routern hanterar det aldrig. Anv\u00e4nd en omv\u00e4nd proxy-WAF f\u00f6r webbplatsen och beh\u00e5ll Threat Prevention f\u00f6r det som det \u00e4r bra p\u00e5.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Which option should I switch on to stop a specific CVE?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Usually none, because the answer depends on whether the vendor shipped a signature for it at all. Open Self-Defined Policy and you will find you can change the action on an existing signature but cannot add one of your own. If no rule exists in the feed, there is nothing to enable, and for a vulnerability a few days old that is the normal case.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Why does my event list only name one or two devices?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Because those are the devices receiving traffic the engine can actually read. On our network it is consistently the mail server, which answers cleartext SMTP on port 25. A web host behind a reverse proxy produces few entries not because it is attacked less, but because its traffic is encrypted at every point the router inspects.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Inspekterar Threat Prevention trafik mellan enheter p\u00e5 mitt LAN?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No. Two devices in the same subnet reach each other through a switch, and the router is not in that path, so the packets are never offered to the inspection engine. The Monitored Interfaces table in Settings shows the real scope, and no option there extends it to same-subnet traffic.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">\u00c4r det s\u00e4kert att l\u00e4mna Threat Prevention aktiverat?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Yes, with one caveat worth knowing. The recommended default passes traffic through unfiltered when the engine is saturated, which keeps your line up at the cost of inspection. The opposite mode drops that traffic instead. We have also had the engine wedge under a flood of harmless exploit attempts and start refusing a server&#8217;s outbound traffic, which cost us a mail outage, so include the router in your list of suspects when a machine goes quiet.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Hj\u00e4lpte Threat Prevention med PHP2Shell \u00f6verhuvudtaget?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>No, and three separate reasons each would have been enough on their own. The traffic was encrypted everywhere the router looks, no Snort or Emerging Threats signature was published for either CVE, and the exploit has no payload shape to match because the first request is defined by the memory it consumes and the second looks completely ordinary. The fix was new PHP packages, with a reverse-proxy WAF covering the gap in the meantime.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">Is disabling session.upload_progress enough on an unpatchable host?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>It helps and it is not enough. Switching it off removes one documented route to CVE-2026-109619, which is worth doing on a host you truly cannot update, but memory exhaustion is reachable by other means and the setting does nothing for CVE-2026-109618. Treat it as borrowed time and plan the package update.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question\">What should I buy or configure first for a NAS-hosted site?<\/h3>\n<div class=\"rank-math-answer\">\n\n<p>Placera en omv\u00e4nd proxy med en hanterad regelupps\u00e4ttning framf\u00f6r webbplatsen, och begr\u00e4nsa sedan ursprunget s\u00e5 att port 443 endast svarar mot det proxyn\u00e4tverket. Dessa tv\u00e5 steg tillsammans flyttar inspektionspunkten till n\u00e5gonstans d\u00e4r beg\u00e4ran \u00e4r l\u00e4sbar och tar bort den kringg\u00e5ende v\u00e4g som skulle upph\u00e4va det. H\u00e5ll Threat Prevention aktiverat efter\u00e5t f\u00f6r utg\u00e5ende command and control och f\u00f6r klartexttj\u00e4nster, vilket \u00e4r d\u00e4r det g\u00f6r verkligt arbete.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<h2 id=\"references-and-video-walkthroughs\" class=\"wp-block-heading\">Referenser och videogenomg\u00e5ngar<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Prim\u00e4ra k\u00e4llor f\u00f6r allt som anges ovan, plus tre genomg\u00e5ngar som \u00e4r v\u00e4rda tiden.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/kb.synology.com\/en-global\/SRM\/help\/ThreatPrevention\/threatprevention_desc\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Kunskapscenter: Threat Prevention<\/a> covers requirements, modes and model support.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/security\/advisory\/Synology_SA_26_14\" target=\"_blank\" rel=\"noreferrer noopener\">Synology-SA-26:14<\/a> lists the fixed PHP package versions for DSM, including the 7.4 build.<\/li>\n\n<li><a href=\"https:\/\/www.synology.com\/en-global\/company\/news\/article\/php2shell\/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities\" target=\"_blank\" rel=\"noreferrer noopener\">Synology Statement on PHP2Shell<\/a> names the affected packages and the one that needs a manual update.<\/li>\n\n<li><a href=\"https:\/\/developers.cloudflare.com\/waf\/managed-rules\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Cloudflare WAF managed rules<\/a> explains how managed rulesets are versioned and deployed.<\/li>\n\n<li><a href=\"https:\/\/www.cloudflare.com\/ips\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Cloudflare IP-intervall<\/a> is the endpoint to read when locking an origin to the proxy instead of hard-coding addresses.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"SRM Threat Prevention \u2013 Realtidsn\u00e4tverksskydd f\u00f6rklarat\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/yT_xGpxGF7k?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">SRM Threat Prevention f\u00f6rklaras, inklusive var paketet \u00e4r placerat i n\u00e4tverket<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Synology Router Hastighetstest med Threat Prevention Aktiverat.\" width=\"1200\" height=\"900\" src=\"https:\/\/www.youtube.com\/embed\/wuuRthcZQ_E?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Ett genomstr\u00f6mningstest med Threat Prevention aktiverat, vilket \u00e4r kostnaden som ingen n\u00e4mner<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Protecting Your Public Websites with Cloudflare WAF\" width=\"1200\" height=\"675\" src=\"https:\/\/www.youtube.com\/embed\/NbEo8p2Hvt8?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">Cloudflare om att skydda offentliga webbplatser med en WAF, lagret som l\u00e4ser f\u00f6rfr\u00e5gan<\/figcaption><\/figure>","protected":false},"excerpt":{"rendered":"<p>Threat Prevention is the package most people reach for the moment they decide to host a website on a Synology NAS. It sits on the router, it has a shield icon, and its dashboard counts attacks in the hundreds, so it looks like the thing that keeps a public site safe. We run it on [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":22124,"comment_status":"open","ping_status":"closed","template":"","meta":{"_eb_attr":"","_xspeed_no_cache":false,"_xspeed_expiry_hours":0,"footnotes":""},"doc_category":[197],"doc_tag":[],"class_list":["post-22125","docs","type-docs","status-publish","has-post-thumbnail","hentry","doc_category-nas-hosting-101"],"year_month":"2026-10","word_count":3684,"total_views":"43","reactions":{"happy":"0","normal":"0","sad":"0"},"author_info":{"name":"Adair Hsu","author_nicename":"adairpk17","author_url":"https:\/\/synopower.club\/sv\/author\/adairpk17\/"},"doc_category_info":[{"term_name":"NAS Hosting 101","term_url":"https:\/\/synopower.club\/sv\/docs-category\/nas-hosting-101\/"}],"doc_tag_info":[],"_links":{"self":[{"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/docs\/22125","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/docs"}],"about":[{"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/types\/docs"}],"author":[{"embeddable":true,"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/comments?post=22125"}],"version-history":[{"count":2,"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/docs\/22125\/revisions"}],"predecessor-version":[{"id":22127,"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/docs\/22125\/revisions\/22127"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/media\/22124"}],"wp:attachment":[{"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/media?parent=22125"}],"wp:term":[{"taxonomy":"doc_category","embeddable":true,"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/doc_category?post=22125"},{"taxonomy":"doc_tag","embeddable":true,"href":"https:\/\/synopower.club\/sv\/wp-json\/wp\/v2\/doc_tag?post=22125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}