For owners of a Synology network storage drive (NAS) and whoever helps them
Is your Synology drive (NAS) open to C3RB3R ransomware?
Synology reports ransomware attacks on drives with outdated system software (DSM). The security firm 360 separately reports ransomware it calls C3RB3R. Install any update DSM offers first. If none shows, or you are unsure, paste your version.
Confirm on Synology's advisory before you rely on it.
Paste your own version in the box.
Your build
Nothing you paste leaves this browser.
5-minute exposure checklist
0 of 7
Seven ways a drive gets reached. Ticks last only while this page is open.
PHP packages (Synology-SA-26:14)
Synology's PHP2Shell update fixes PHP, the scripting language behind the web packages below. It covers DSM 7.4, 7.3 and the end-of-life 7.2, 7.1, 7.0 and 6.2.
Synology Drive is not affected. Below DSM 6.2, turn these packages off and move to a supported DSM. Flaw numbers (CVE): CVE-2026-109618 and CVE-2026-109619.
Already hit? (.L0CK3D files or read-me3.txt)
Do these in this order.
- Unplug the network cable from the drive.
- Do not restart or wipe it. Shut it down only if you cannot cut it off from the network.
- Do not pay, and do not contact the people behind the note.
- Keep the note file (read-me3.txt) and a few of the locked files. Do not delete them.
- Photograph the screen and the note, with the date and time.
- Contact Synology Support and report it.
Updating closes the flaws in Synology's advisories. It does not recover locked files, and a drive that was hit may still hold the intruders' access: have it checked, remove unknown accounts and change every password before it goes back online.
How Moat works
Moat splits the version into the release (like 7.2.1), the build number (like 69057) and the update number (like 8). It compares the build, then the update number, with the fixed build in each Synology advisory that lists your release.
Moat checks every critical advisory on Synology's list whose table names DSM 6.2 or newer: eight, from Synology-SA-18:62 to Synology-SA-26:19, read to the end of the list (446 advisories) on November 12, 2026. Left out: Synology-SA-22:17, which covers only three models (DS3622xs+, FS3410, HD6500), advisories for packages rather than DSM, and those for DSM 6.1 or older, which always get Check.
A release no advisory lists is never shown as fixed. DSM 7.2, 7.1, 7.0 and 6.2 are end-of-life on Synology's pages, so they get Check at best.
Moat also reads the lines of the file /etc.defaults/VERSION. It cannot see your settings, your packages or whether files are already locked, so use the checklist and the card.
Facts:
- Synology-SA-26:19: critical, published November 10, 2026, fixed builds for DSM 7.4, 7.3, 7.2.2 and 7.2.1
- Synology-SA-26:13: critical, published September 18, 2026, fixed builds for DSM 7.4, 7.3, 7.2.2 and 7.2.1. The security firm 360 traced the C3RB3R cases it looked into to flaws in this advisory (Gridinsoft)
- Synology-SA-26:03: critical, published March 19, 2026 (GNU Inetutils), fixed builds for DSM 7.3, 7.2.2 and 7.2.1
- Synology-SA-24:20: critical (moderate for DSM 6.2), published November 5, 2024 (Pwn2Own 2024), fixed builds for DSM 7.2.2 down to 6.2. Synology's ransomware notice points to this advisory
- Synology-SA-22:06 (Netatalk, 2022), Synology-SA-20:26 (2020, important for DSM 6.2), Synology-SA-18:64 and Synology-SA-18:62 (2018): critical, fixed builds for DSM 7.1, 7.0 and 6.2
- Synology's advisory list, read to its end on November 12, 2026: 446 advisories; these eight critical ones name DSM 6.2 or newer. Only Synology-SA-26:13 and Synology-SA-24:20 are tied to the attacks by any report
- Synology news, October 29, 2026: update DSM after ransomware attacks on outdated versions, and turn on automatic updates. Synology's notice does not name the ransomware; the name C3RB3R comes from the security firm 360 (Gridinsoft)
- Synology news, PHP2Shell: PHP updates for DSM 7.4 down to 6.2
- Gridinsoft, updated October 30, 2026: the C3RB3R marks (.L0CK3D files, read-me3.txt), Synology's response checklist for a drive already hit, and that the public reports do not establish that Synology's notice and 360's cases are the same attacks
Builds last checked: 2026-11-12. Moat is an aid, not a guarantee. Not affiliated with Synology. Help: grapnel.team@gmail.com · Privacy · Terms · Accessibility