Ransomware Hits Synology NAS Through 18-Month-Old Unpatched Flaw

A Synology DS918+ NAS left roughly 18 months without security patches was hit by ransomware that encrypted its files, after attackers abused a remote code execution vulnerability disclosed a year and a half ago. The victim, Reddit user NakamuraHwang, documented the incident in a detailed write-up that doubles as a case study in how technically capable people still lose to basic hygiene failures.

Two unforced errors made the attack possible. The unit's web interface sat directly exposed to the internet, and the device ran without current security patches for about 18 months. As the recent PHP supply-chain incident also showed, complacency does more damage than sophisticated tooling.

What did the attacker actually use?

Hwang's investigation points to CVE-2024-10441, a remote code execution flaw Synology disclosed some eighteen months before the attack. The user did not lose data, thanks to a 3-2-1 backup arrangement. To inspect the damage, they attached the disks to a Proxmox machine and examined logs and operating system files there. That works because Synology's DSM operating system uses mdraid underneath, so the disks mount on another box without proprietary tooling.

The takeaway: a known, patched, year-and-a-half-old vulnerability was still enough to encrypt a technically competent owner's files.

Why did the device look up to date when it was not?

Here the story shifts from user error to vendor behavior. According to multiple comments on the Reddit thread and other forums, the DSM interface will report that a device is fully up to date even while critical security updates wait for manual installation. Synology's own manual indicates that units from 2025 onwards receive automatic updates, which implies that earlier models must be configured to get them.

Package updates compound the problem. The patch for the PHP2Shell vulnerability, for example, has to be installed separately from the base system, adding another step an owner can silently miss.

The takeaway: an update indicator that says "current" while critical fixes sit unapplied is not a minor UI quirk; it is the mechanism that let this attack succeed.

Does Synology warn its customers?

Apparently not in any direct way. Synology published an advisory for CVE-2024-10441, but the company appears to lack a channel — even a simple e-mail notification would do — to tell customers that a critical vulnerability affects their hardware. Although Synology seems to be shifting away from consumer gear, it still sells small units that ordinary buyers purchase, and expecting those buyers to track security bulletins is not reasonable.

The takeaway: publishing an advisory on a website is not the same as informing the installed base.

What should owners of exposed devices do?

The standard advice applies here and Hwang's case illustrates it. Any device exposed to the internet should sit behind a protective layer, chiefly a VPN or an SSH tunnel, though those are not the only options. Tools such as Tailscale make running a VPN largely painless, and its free plan covers most home installations.

The lesson the sysadmin community keeps relearning: the advice its members dispense to others applies to their own gear too.

The takeaway: exposure plus missed patches plus a misleading status indicator equals a ransomware incident, no matter how skilled the owner.

What happens next?

For Synology, the pressure now falls on delivering automatic updates and direct vulnerability notifications to its pre-2025 installed base, before more of those units — many still showing a false "up to date" signal — meet the same fate.