TheRetroArcade
Veteran
Posts: 13,437
Joined: Feb 2026
Joined: Feb 2026
Big oof.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Another day, another cybersecurity update. This time, it's the turn of immensely popular NAS provider Synology to advise its users about some now-fixed gaping holes. The company has updated its DiskStation Manager (DSM) operating system, patching out two security vulnerabilities in various product versions.
Just another patch? Not quite. The first of these vulnerabilities has a CVSS3 base score of 9.8 out of 10, which makes it of "critical" severity (via International Cyber Digest on X). According to the company:
"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM)... allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."
That's a pretty big security hole if I've ever seen one, particularly for those storing extremely important data on their home NAS setup. The second one gets a lower severity rating of 8.6, but also manages to allow attackers to skip the login process.
Synology describes the second vulnerability as "An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager," which can again lead to unwanted reads, writes, and DDOS shenanigans.
‼️BREAKING: A critical flaw in Synology NAS devices lets attackers read and write any file on them without logging in.
The SQL injection bug in their login system scores 9.8 out of 10. A second flaw, in rsync, skips the login too.
Synology patched both today. Update ASAP. https://t.co/LlS328SBf4November 11, 2026
The company also notified users late last month of ransomware attacks related to a 2024 security advisory, for what looks to be a series of separate vulnerabilities. One way or the other, the latest updates look to have rolled out to many users already, but it's still worth checking to make sure you're on the newest builds to plug all these leaks.
After all, auto updaters are far from perfect. 2026 has been a year characterised by cybersecurity issues, and it'd really put the tin lid on it if your home NAS was broken into by some unscrupulous character. A reminder to keep on top of your updates no matter the device, methinks. Stay safe out there, folks.
The PC Gamer Circuit Breaker newsletter breaks down the latest PC gaming tech, and finds you the best deals on the best products
1. Best gaming chair: Secretlab Titan Evo
2. Best gaming desk: Secretlab Magnus Pro XL
3. Best gaming headset: Razer BlackShark V3
4. Best gaming keyboard: Asus ROG Strix Scope II 96 Wireless
5. Best gaming mouse: Razer Viper V4 Pro
6. Best PC controller: GameSir G7 Pro
7. Best steering wheel: Logitech G Pro Racing Wheel
8. Best microphone: Shure MV6 USB Gaming Microphone
9. Best webcam: Elgato Facecam MK.2
👉Check out our list of guides👈
Andy built his first gaming PC at the tender age of 12, when IDE cables were a thing and high resolution wasn't. 26 years later (yes he's getting old), he now spends his days writing about and reviewing graphics cards, CPUs, keyboards, mice, gaming headsets and much, much more. You name it, if it's PC gaming hardware he'll write words about it, with opinions and everything.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.Read more: Full article on www.pcgamer.com
What do you think about this?
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Another day, another cybersecurity update. This time, it's the turn of immensely popular NAS provider Synology to advise its users about some now-fixed gaping holes. The company has updated its DiskStation Manager (DSM) operating system, patching out two security vulnerabilities in various product versions.
Just another patch? Not quite. The first of these vulnerabilities has a CVSS3 base score of 9.8 out of 10, which makes it of "critical" severity (via International Cyber Digest on X). According to the company:
"An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM)... allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks."
That's a pretty big security hole if I've ever seen one, particularly for those storing extremely important data on their home NAS setup. The second one gets a lower severity rating of 8.6, but also manages to allow attackers to skip the login process.
Synology describes the second vulnerability as "An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager," which can again lead to unwanted reads, writes, and DDOS shenanigans.
‼️BREAKING: A critical flaw in Synology NAS devices lets attackers read and write any file on them without logging in.
The SQL injection bug in their login system scores 9.8 out of 10. A second flaw, in rsync, skips the login too.
Synology patched both today. Update ASAP. https://t.co/LlS328SBf4November 11, 2026
The company also notified users late last month of ransomware attacks related to a 2024 security advisory, for what looks to be a series of separate vulnerabilities. One way or the other, the latest updates look to have rolled out to many users already, but it's still worth checking to make sure you're on the newest builds to plug all these leaks.
After all, auto updaters are far from perfect. 2026 has been a year characterised by cybersecurity issues, and it'd really put the tin lid on it if your home NAS was broken into by some unscrupulous character. A reminder to keep on top of your updates no matter the device, methinks. Stay safe out there, folks.
The PC Gamer Circuit Breaker newsletter breaks down the latest PC gaming tech, and finds you the best deals on the best products
1. Best gaming chair: Secretlab Titan Evo
2. Best gaming desk: Secretlab Magnus Pro XL
3. Best gaming headset: Razer BlackShark V3
4. Best gaming keyboard: Asus ROG Strix Scope II 96 Wireless
5. Best gaming mouse: Razer Viper V4 Pro
6. Best PC controller: GameSir G7 Pro
7. Best steering wheel: Logitech G Pro Racing Wheel
8. Best microphone: Shure MV6 USB Gaming Microphone
9. Best webcam: Elgato Facecam MK.2
👉Check out our list of guides👈
Andy built his first gaming PC at the tender age of 12, when IDE cables were a thing and high resolution wasn't. 26 years later (yes he's getting old), he now spends his days writing about and reviewing graphics cards, CPUs, keyboards, mice, gaming headsets and much, much more. You name it, if it's PC gaming hardware he'll write words about it, with opinions and everything.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.Read more: Full article on www.pcgamer.com
What do you think about this?