Synology NAS Ransomware: C3RB3R Attacks Hit Outdated DSM Versions, What Is Confirmed and the Updates to Install
Synology says attackers are encrypting NAS devices that run outdated DSM, using a flaw patched in 2024. Here is what is confirmed, what is only reported, and the DSM versions to check this week.
Where Worldwide
On this page 9 sections
Synology says attackers are breaking into Synology NAS devices running outdated versions of its DSM operating system, then encrypting the files and demanding a ransom. If your business keeps shared files or backups on a Synology box, check its DSM version today. The flaw being used was fixed in 2024, so the devices at risk are the ones that never got the update.
What Synology has confirmed
On Thursday, October 29, 2026, Synology published a notice saying it "has identified threat actors exploiting a vulnerability originally patched in December 2024." Synology says the attacks target devices running outdated DSM versions and aim to encrypt data and demand ransom.
Synology's advice is short:
- Update DSM right away if you are on a vulnerable version.
- Turn on automatic updates so DSM stays current.
- See its security advisory Synology-SA-24:20 for the technical details.
So far, that is everything Synology itself has confirmed about the attacks.
What is reported but not confirmed by Synology
Most of the remaining detail comes from BleepingComputer's report of November 2, 2026, and from victims posting online. Treat these points as reported, not confirmed:
- The name. BleepingComputer calls this the C3RB3R ransomware (also written Cerber or CerberImposter). Synology's notice does not name the ransomware.
- What victims see. According to the report, victims find files renamed with a .L0CK3D extension and a ransom note called read-me3.txt. The note asks for payment for a "C3rb3r Decryptor" sold through a dark web portal.
- Timing. BleepingComputer says the first victim reports appeared more than two weeks before its article.
- Which flaw. Synology has not said which vulnerability is being used. A Synology spokesperson pointed BleepingComputer to SA-24:20, which covers three flaws, but nobody has publicly said which of them, if any, is being exploited.
- How many devices. BleepingComputer cites Shadowserver as tracking more than 380,000 Synology NAS devices exposed to the internet. That number says nothing about how many are unpatched.
One detail doesn't line up. Synology's notice says the flaw was patched in December 2024, but SA-24:20 was first published on November 5, 2024. The only December 2024 entries in its revision history are from December 5, 2024, when DSM 6.2 was added as affected and its update was released. Synology has not explained this.
What Synology-SA-24:20 fixes
SA-24:20 is rated Critical. It covers flaws reported through the Pwn2Own 2024 hacking contest:
- CVE-2024-10441 (CVSS 9.8, Critical): remote code execution through the system plugin daemon.
- CVE-2024-50629 (CVSS 5.3, Moderate): remote reading of limited files through the web API.
- CVE-2024-10445 (CVSS 4.3, Moderate): writing limited files through a certificate check flaw in the update feature.
The fixed versions from the advisory:
| DSM version | Severity | Install this or later |
|---|---|---|
| DSM 7.2.2 | Critical | 7.2.2-72806-1 |
| DSM 7.2.1 | Critical | 7.2.1-69057-6 |
| DSM 7.2 | Critical | 7.2-64570-4 |
| DSM 7.1 | Critical | 7.1.1-42962-7 |
| DSM 6.2 | Moderate | 6.2.4-25556-8 |
There is a catch. In a companion notice, also dated October 29, 2026, Synology lists DSM 7.2, 7.1, 7.0 and 6.2 as end of life. Being on the fixed build for this advisory is the minimum. If your hardware supports it, plan the move to a supported DSM release.
The separate Synology PHP2Shell fixes
In that same companion notice, Synology says it is extending fixes for the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, to older DSM releases. Synology treats these as a separate issue and does not say the ransomware uses them. Its advisory SA-26:14 rates both CVSS 9.8.
According to the news notice, the affected packages are Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM, Web Station and WordPress. The SA-26:14 advisory page itself lists fixed versions for Synology Calendar, Mail Station and the PHP 7.4 to 8.4 packages. PHP 7.3 is end of life and gets no fix.
Synology's steps: update PHP in Package Center, which restarts the packages that depend on it, and update MailStation by hand. If you are on DSM older than 6.2, turn off the affected packages until you can upgrade. Our earlier post on the PHP2Shell vulnerability explains the PHP side.
How to check your Synology DSM version
Sign in to DSM as an admin and open Control Panel, then Info Center, where the DSM version and build number are shown. Compare that build with the table above. Updates and automatic update settings are under Control Panel, then Update & Restore. PHP and other package updates are in Package Center.
What to do this week
| Task | How to check | Done when |
|---|---|---|
| Find every Synology NAS | Check office, branch and home office devices, including old backup units | You have a list with model and DSM build |
| Patch for SA-24:20 | Info Center build vs the table above | Every device is on the fixed build or later |
| Plan off end-of-life DSM | Note devices on DSM 7.2 or older | A date to move to a supported DSM, or to replace the hardware |
| Update PHP packages | Package Center | PHP, Calendar and MailStation are on SA-26:14 fixed versions |
| Turn on auto updates | Update & Restore | Automatic DSM updates are on |
| Close internet access to DSM | Router port forwards and firewall rules | The DSM admin page can't be reached from the internet (BleepingComputer recommends blocking it) |
| Look for signs | Shared folders | No .L0CK3D files or read-me3.txt notes |
| Test a restore | Restore a real folder from a copy the NAS can't overwrite | The restore works |
Why this matters for a company network
In many offices, the NAS is where the shared drive and the backups live. If ransomware encrypts it, you can lose your working files and your recovery copy in the same incident. That's why this campaign hurts more than an attack on a single laptop.
There are two lessons here. First, a NAS is a server, and someone has to own its updates. Our post on who is patching your servers covers that gap. Second, "it updates itself" only holds while the hardware still gets a supported DSM release. Once it falls off support, updates stop arriving. We wrote about that in updated is not the same as patched.
Keep at least one backup copy that the NAS itself can't reach or overwrite, such as an offline drive or an off-site copy with separate credentials. Then test that you can actually restore from it.
Synology ransomware questions people are asking
Is my Synology NAS at risk from C3RB3R ransomware?
Synology says the attacks target devices on outdated DSM versions. If your NAS is below the fixed builds in SA-24:20, treat it as at risk and update now.
Which Synology vulnerability is being exploited?
Synology has not named it. It points to SA-24:20, which covers CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445, but it has not said which one is in use.
What are the signs of C3RB3R on a NAS?
Victims report files renamed with a .L0CK3D extension and a ransom note called read-me3.txt. Those details come from victim reports, not from Synology.
Is DSM 7.2 still supported?
No. Synology's October 29 notice lists DSM 7.2, 7.1, 7.0 and 6.2 as end of life.
Is the PHP2Shell flaw behind these attacks?
Synology hasn't said so. It handles the PHP2Shell fixes (SA-26:14) separately from the ransomware warning (SA-24:20).
Should my NAS be reachable from the internet?
The DSM admin page should not be. BleepingComputer's report recommends blocking internet access to the management interface. For remote access, use a VPN instead.
The bigger lesson
This attack works because a fix from 2024 never reached some machines. A storage box that sits in a closet and "just works" still needs an owner, a patch schedule and a plan for when its software reaches end of life. Backups only protect you if an attacker on your network can't touch them.
To get your NAS and servers patched and locked down, see security hardening or ask us for a quote.
Get security alerts like this by email, with our free checklist, at security alerts.
Sources: Synology: update DSM following ransomware attacks; Synology-SA-24:20; Synology: PHP2Shell fixes for older DSM; Synology-SA-26:14; BleepingComputer.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Refrigeration Controller Hacks: CISA and FBI Warn Cold-Chain Businesses, What Is Confirmed and the Danfoss Firmware to Check
US agencies say attackers are targeting refrigeration and cold-chain controllers after two waves of store atta...
Cold Chain Cyberattacks: FBI and CISA Warn Refrigeration Controllers Are Being Targeted, What France Confirmed and What to Check This Week
Attackers changed refrigeration settings at about 700 French retail sites in October, and US agencies now urge...
Plex2Shell QNAP NAS Exploit: Attackers Compromise Plex Media Server on NAS Devices, the Fixed Version and How to Check Yours
QNAP says attackers have compromised Plex Media Server on some NAS devices using Plex2Shell, a four-flaw chain...
