{
  "id": 17061486,
  "title": "Tech whizz's internet-accessible Synology NAS gets bit by ransomware attack from 18-month-old remote code execution flaw — security updates neglected in a series of catastrophic errors",
  "url": "https://urgent.news/2026/10/29/tech-whizzs-internet-accessible-synology-nas-gets-bit-by-ransomware",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-29T12:41:14.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cyber-security/tech-whizzs-internet-accessible-synology-nas-gets-bit-by-ransomware-attack-from-18-month-old-remote-code-execution-flaw-security-updates-neglected-in-a-series-of-catastrophic-errors"
  },
  "original_language": "en",
  "account": "A tech-savvy individual experienced a ransomware attack on their internet-connected Synology Network Attached Storage (NAS) device, which turned out to be the result of a combination of factors. The NAS, a Synology DS918+, had its web interface directly accessible to the internet and had been out-of-date with security patches for approximately 18 months. The attacker exploited a known remote code execution vulnerability, CVE-2024-10441, which had been disclosed a year and a half earlier. The victim, identified as Reddit user NakamuraHwang, had a 3-2-1 backup strategy in place, safeguarding their data against any potential loss. To investigate the incident, the disks were extracted from the NAS and connected to a Proxmox machine, allowing the system to mount the disks using mdraid underneath Synology's DSM operating system. Security experts advise against exposing devices directly to the internet without an additional protective layer, such as a VPN or SSH tunnel. Synology had released an advisory regarding the exploit, but users were unaware of the need to manually install critical security updates, as the NAS interface falsely indicated that the device was up to date. Synology's support manual suggests that newer units have automatic updates enabled, implying that older models require manual configuration. Moreover, Synology does not provide a direct communication channel for customers to receive notifications about critical security vulnerabilities, which could have potentially prevented this incident. Although Synology is narrowing its focus away from consumer-grade hardware, it still manufactures small units that could potentially fall into the hands of regular users who may be unaware of security advisories. Additionally, some security patches, such as the PHP2Shell vulnerability, must be installed separately, adding to the complexity of maintaining a secure NAS environment.",
  "summary": "Tech whizz' internet-accessible Synology NAS gets bit by transomware attack — security updates 18 months out of date in a series of catastrophic errors",
  "key_points": [
    "Tech-savvy individual's Synology NAS attacked by ransomware",
    "18-month-old remote code execution vulnerability exploited",
    "Security updates neglected, leading to catastrophic errors"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}