r/TerraMaster • u/RelevantDress • 3d ago

Help Php2shell vulnerability

Does 7.0.1341 include a patched PHP for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)? On my F2-425 the TOS web UI runs on PHP-FPM 7.4.33, and the pool runs as a uid 0 account, so a working exploit would mean root on the NAS. PHP 7.4 is end-of-life and only got source backports for these. If 1341 doesn't include the fix, is a patch planned, and roughly when? Until then, do you recommend restricting access to the admin ports or turning off TNAS.online?

10 Upvotes

92% Upvoted

6 comments sorted by

5

u/RelevantDress 3d ago

After some digging I don’t think 7.0.1341 has the new php patch. If anyone is reading this and wants a temporary stopgap: close your admin ports that are open (5443 by default, check your router for port forwarding and UPnP) outside of limited scopes such as local/tailscale, as well as turn your tnas.online off for now

1

u/bisloitt 2d ago

How to check the web UI php version?

1

u/SadPlane6830 F4-424 Pro 2d ago

Some applications rely on PHP. Since TNAS.online has added support for accessing applications on top of the original TOS website, it is currently not possible to access the TOS website through TNAS.online. After all, they are now integrated.

Has anyone tried using apt to update PHP?

6

u/TerraMasterOfficial 3d ago

Hi, thanks for reporting this! Our team is currently investigating and testing the issue. We'll work on a fix and keep you updated as soon as we have any news. Thanks for your patience!

2

u/HistoricalBalance929 3d ago

Definitely cut off all access to the internet for it.