Key Takeaways

  • Synology is urging customers to update DiskStation Manager after ransomware attacks targeted outdated DSM installations.
  • Older NAS models may not support current DSM releases, forcing administrators to isolate, restrict, or replace affected hardware.
  • Offline or immutable backups and tested recovery procedures remain important because NAS snapshots alone may offer limited protection.

Synology has urged customers to update DiskStation Manager after ransomware operators targeted outdated DSM installations, putting renewed attention on the security risks surrounding internet-connected network-attached storage.

The warning carries particular weight for smaller businesses. Synology appliances frequently combine shared storage, backup, file collaboration, surveillance video management, and application hosting in one box. That consolidation can simplify operations, but it also concentrates valuable data and administrative access in a system that attackers can identify from the public internet.

Recent Synology security advisories describe critical DSM vulnerabilities involving arbitrary file reads or writes and denial-of-service conditions. Fixes have been issued across DSM 7.2.1, 7.2.2, 7.3, and 7.4. Synology published a separate 2026 advisory covering vulnerabilities in DSM-associated PHP versions, including the end-of-life PHP 7.3, and packages such as Calendar and Mail Station.

Installing updates is not equally straightforward across the installed base. DSM support depends on the appliance model and hardware generation. Some older systems cannot progress beyond DSM 7.1, DSM 6.2, or DSM 5.2, even when newer releases contain relevant security corrections.

This creates hardware lifecycle challenges for IT departments. A storage appliance may still function perfectly well from an operational perspective while no longer supporting a sufficiently current software branch. In those cases, administrators can reduce exposure by removing direct internet access, disabling affected packages, restricting management interfaces, segmenting the device, or planning hardware replacement.

Patch visibility is another concern. Synology's release notes indicate that certain security updates may require manual installation because affected devices might not receive an automatic notification. Organizations relying only on update prompts could therefore miss a correction that is available for their particular model.

A practical response starts with inventory. Administrators should identify every Synology appliance, record its exact model and DSM version, list installed packages, and determine whether any management or application interfaces are publicly reachable. Forgotten branch-office devices and appliances installed for a single department deserve special attention, as they tend to sit outside routine endpoint-management workflows.

Authentication controls matter too. Administrators can disable unused default accounts, require multifactor authentication where supported, limit administrative access to trusted networks or a VPN, and review logs for unfamiliar sign-ins, account changes, or sudden file activity. None of these controls replaces patching, but layered restrictions can reduce an attacker's options.

The issue also reaches beyond Synology. QNAP and Western Digital/SanDisk appliances can face similar challenges involving public exposure, unsupported software, optional packages, and long-lived hardware. How many organizations can produce a current list of every NAS device connected across headquarters, remote offices, and home-based work sites? For many, that basic inventory exercise may reveal the larger governance gap.

NIST Cybersecurity Framework 2.0 offers a useful way to structure the response. Its Govern function supports clear ownership for appliance lifecycle decisions, Protect covers configuration and access controls, and Recover emphasizes restoration planning. The CIS Controls v8.1 similarly highlights asset inventory, vulnerability management, secure configuration, access control, and data recovery.

Recovery deserves extra scrutiny. Snapshots stored on the same NAS can help reverse accidental deletion or limited file corruption, but they should not be treated as a complete ransomware strategy. If an attacker gains administrative control, locally accessible snapshots and connected backups may also be deleted, encrypted, or altered.

An offline or immutable backup is only as useful as the organization's ability to restore it. Businesses should test recovery procedures, confirm credentials and encryption keys are available, and measure whether restoration can meet operational expectations. Those exercises often expose missing dependencies before an incident does.

Synology's warning is therefore about more than applying one DSM update. It is a reminder that storage appliances are managed systems with software dependencies, exposure paths, and finite support lives. Organizations that connect them to the internet without ongoing patch verification and recovery testing are taking on risk that may remain hidden until the data is already under attack.