Hi everyone! There was a moment a few days ago when I opened Package Center and just stopped. Not because something was broken, but because in less than two weeks three critical vulnerabilities, a new ransomware wave on Synology, and a serious issue on Tailscale had all arrived. All at once. This isn’t the usual “everything is fine, just update”. It’s one of those periods where anyone running a self-hosted NAS (Synology, Unraid, Asustor, UGREEN, or pure Docker) needs to pay attention because the patches are coming quickly and anyone who falls behind is really at risk. If you’ve been following the guides here on mariushosting, in many cases you’re already protected. But let’s go through it in order.
PHP2Shell and CVE-2026-115560: Those Who Followed Mariushosting Are Covered
On October 21 PHP2Shell broke: two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in the PHP engine itself. They allow remote code execution without authentication. CVSS 9.2/9.8. The kind of thing that makes you stop everything and update. It affects not only classic websites but also NAS interfaces, firewalls, Nextcloud or any Docker that uses an old PHP version also. For Docker containers, just set up Dockhand to automatically schedule container updates. Otherwise, if you are using Portainer, install Watchtower using my easy guide. On Synology, the risk mainly concerns packages that use PHP: Web Station, Calendar, Mail Station, WordPress, phpMyAdmin, and others listed in the official advisory.
Synology reacted. It released the PHP updates (for example PHP 8.4.27-0051, 8.3.36-0051, etc.) and extended the patches to end-of-life DSM versions as well. Anyone who followed the temporary mitigation guide (disabling session.upload_progress) and then installed the updated packages is safe. DSM’s internal PHP has no external attack surface, so the risk there is considered very low. A few days later, CVE-2026-115560 also arrived, another remote code execution vulnerability still tied to session.upload_progress in PHP. It does not bypass the PHP2Shell patches and is considered low real-world risk by PHP (it requires rare serialize_handler configuration conditions).
The recommended protection is exactly the same: disable session.upload_progress.enabled. Anyone who followed the advice published here on October 21 (setting session.upload_progress.enabled = 0 in the Web Station PHP profiles) is already covered by this CVE as well. No additional steps are needed. Still keep using Synology’s updated PHP packages for the other fixes. If you haven’t done it yet: go to Package Center, update the PHP packages and the services that depend on them. And check the profiles in Web Station.
☊ Node.js and Synology’s Patches
Almost at the same time came the Node.js security issue (October 2026). Among the ten vulnerabilities there is a particularly serious one in the Brotli decoder (CVE-2026-111497) that can lead to remote code execution. The fixed versions are 22.23.4, 24.22.1, and 26.12.1. Older lines (including Node 20) do not receive fixes because they are end-of-life. Synology has already released the new packages. Check in Package Center or manually download the Node.js v22 update. Some packages (like Synology Photos) still use Node 20, which is EOL (End of life), so keep an eye on future updates and, if you use Synology Photos, switch to Immich.
🥷Why Many Synology NAS are Being Hacked Lately
A clear PSA has been circulating online and in various forums: update DSM. In recent days ransomware cases have increased (C3RB3R / L0CK3D variant) that encrypt files on Synology NAS by adding extensions like .L0CK3D and leaving ransom notes. It all comes down to old, un-updated DSM versions. The vulnerabilities being used (for example, those from the November 2024 Synology-SA-24:20 advisory) have already been patched for a long time, since 2024. A NAS left behind for months or years becomes an easy target, whether it’s reachable from outside or attacked from the local network.
If ransomware enters a PC on the network (via phishing email, a clicked attachment, or something else), it can move laterally. SMB shares, mounted folders, saved credentials, backup scripts; the malware doesn’t stop at a single computer. If it finds a NAS with known vulnerabilities that is accessible from the local network, it can hit that too. In many of my guides I recommend port forwarding when you need speed and simplicity. For those who use it, my Deny IP List is a useful tool: an updated blacklist of malicious IPs to import into the DSM (or SRM) firewall to block brute-force attempts and known attacks. Import it as a Block List, set expiration to Forever, and overwrite existing lists. Practical advice: update DSM and all packages immediately. Use the Deny IP List if you have exposed services. Keep backups offline or in an isolated location. A single infected PC on the network can become the launch pad toward an unpatched NAS.
💻Tailscale and “Tailworm”
A researcher published a report (Tailworm) with 11 findings on Tailscale and Headscale. The most serious ones concern Tailscale SSH: with a device already authorized in the tailnet and SSH rules that allow it, certain forwarding operations could run as root and reach privileged sockets (e.g. Docker socket or local API). Tailscale released version 1.104.4 which fixes the main issues (TS-2026-014 and related). Update the client. It is not an attack from unauthenticated outsiders, but if you have SSH enabled and a compromised device, there was a risk of lateral movement.
How About Hardware?
No dramatic hardware revolutions in these 15 days, but security has monopolized attention. And rightly so.
UGREEN NAS
A few things happened on the UGREEN side as well in recent days. Several NASync models (DH2300, DH4300 Plus, DXP2800, DXP4800 Plus, and DXP6800 Plus) are currently 10-15% off on Amazon. The iDX6011 series continues to lag on updates: while the DH and DXP lines received UGOS Pro 1.20 at the end of September, the iDX models still haven’t. I still strongly advise against any NAS from the DH series. Don’t let the glowing YouTube reviews fool you. More details here: Which UGREEN NAS Should I Avoid? Nothing critical on the security side, but if you own an iDX, keep an eye on firmware updates.
🎗️A (Unfortunately) Recurring Note About Donations
I continue to receive 0.01 cent donations. It happens often. They are not donations: they are mockery, sometimes accompanied by messages like “this is how much your work is worth.” Every refund costs me time and fees. In the last month support has dropped quite a bit. The blog has no ads, sponsors, or affiliate links.
It lives only thanks to those who decide to say “thank you, keep going”. If you want me to keep testing, writing guides, and doing these roundups, help from the community is necessary. You’ll find everything here: Why I ask for donations. Thanks to those who already support. You are the ones who keep all of this standing.
🎄A Small Personal Note
I started decorating the Christmas tree in the garden for the first time. I began early. My tree is a Nordmann planted 7 years ago when it was only 50 cm. Today it has almost reached 5 meters and I started putting up the Christmas lights. It’s nice to see it grow like this. See you at the next roundup. In the meantime: update DSM and the packages, use the Deny IP List if you need it, and make backups. The rest is noise.
New articles and updated Compose files are already in the pipeline. See you in the next November 15, 2026 Roundup update. Below you will find the most recent guides updated at the end of October 2026.
Immich is a very high performance self-hosted photo and video backup solution directly from your mobile phone. You can run Immich on your Synology NAS and it lets you upload photos and videos from your browser or mobile phone via the dedicated Android Immich app or the iOS Immich app. The Immich user interface feels like Google Photos, especially if you are using the mobile apps. Note: Install Immich on Your Synology NAS.
Paperless-ngx is a document management system that transforms your physical documents into a searchable online archive so you can keep, well, less paper. Note: Install Paperless-NGX on Your Synology NAS.
WikiDocs is an Open Source, databaseless, markdown, flat-file wiki engine. It’s designed to be simple yet powerful, making it a great tool for creating and managing wikis without the complexity of a database. Note: Install WikiDocs on Your Synology NAS.
Antimatter is a community-maintained fork of Mattermost that removes commercial restrictions, user/message limits, and other paywalled or enterprise-only elements, delivering a fully unrestricted open-source self-hosted team collaboration platform focused on chat and core features without the corporate overhead. In my homelab I’ve been running it for days as the central hub for family and a few friends. I use it for group chats, sharing links and files. It’s lightweight and reliable. Mattermost is the original product that increasingly puts limits and paid walls on previously free features. Antimatter is the cleaned-up, unrestricted fork that keeps only the open-source parts, removes all the commercial restrictions and nagging, and aims to stay fully free for self-hosters. Note: Install Antimatter on Your Synology NAS.
Layerling is a free, open-source browser-based 3D CAD tool aimed at 3D printing enthusiasts who want functional parts without learning complex software or creating an account. It works much like Tinkercad: drag shapes onto a virtual build plate, turn some into holes, group them, and export. Layerling adds practical features such as chamfers and fillets that remain editable, sketches, threads, gears, hole patterns, hollowing, STEP export for true CAD geometry, multicolour support, and printer-specific build plates with overhang warnings. Designs stay entirely local in the browser, require no sign-up, and can even be driven by an AI assistant via its MCP server. I recently designed a simple phone stand with rounded edges and a cable slot using Layerling. Within a few minutes I had dropped a couple of boxes, cut the slot, applied a fillet to the top edges, and exported a clean STL, something that would have been far more fiddly in Tinkercad and far heavier in a full CAD package. The interface felt immediately familiar, the lack of any account friction was refreshing, and the part printed perfectly the first time. Note: Install Layerling on Your Synology NAS.
Dockhand is a modern, self-hosted Docker management platform with an intuitive web interface for homelabs, small businesses, and enterprises. It simplifies container operations, stack deployments, and observability through real-time management (start/stop/restart containers, web terminals, file transfers), a visual Compose editor, GitOps auto-sync, metrics, logs, OIDC/SSO, MFA, vulnerability scans, and multi-host support via the open-source Hawser agent. You can deploy it quickly as a Docker container with no cloud dependencies or telemetry. It’s forever free for personal use. Note: Install Dockhand on Your Synology NAS.
Portainer is a lightweight management UI which allows you to easily manage your Docker host or Swarm cluster. Portainer is meant to be as simple to deploy as it is to use. It consists of a single container that can run on any Docker engine (Docker for Linux, Docker for Synology DSM and Docker for Windows are all supported). Portainer allows you to manage your Docker stacks, containers, images, volumes, networks and more! It is compatible with the standalone Docker engine and with Docker Swarm. Note: Install Portainer on Your Synology NAS.
Termix is an open-source, forever-free, self-hosted, all-in-one server management platform. It provides a web-based solution for managing your servers and infrastructure through a single, intuitive interface. Termix offers SSH terminal access, SSH tunneling capabilities, and remote file editing, with many more tools. Note: Install Termix on Your Synology NAS.
Dawarich is a self-hosted web app designed to replace Google Timeline (aka Google Location History). It enables you to: visualize your data on an interactive map, import your location history from Google Maps Timeline and Owntracks and explore statistics like the number of countries and cities visited, total distance traveled, and more. Note: Install Dawarich on Your Synology NAS.
💡Tagr
Tagr is a self-hosted web application that lets you browse, play, and edit the metadata of your music files from any browser. You simply point it at your music folders and get a clean three-panel interface for navigating the library, listening to tracks, and writing tag changes directly back to the audio files. It supports a wide range of formats, offers full change history with the ability to revert edits, includes a waveform-based player with listen tracking, and works smoothly on a NAS. I’ve been running Tagr as my everyday music library companion for a while now. Whenever I add new tracks or notice incomplete tags, I open it in the browser, fix the metadata on the spot, listen through the built-in player, and keep everything consistent without switching to a desktop app. Note: Install Tagr on Your Synology NAS.
Dozzle is a simple and responsive application that provides you with a web based interface to monitor your Docker container logs live. It doesn’t store log information, it is for live monitoring of your container logs only. I use Dozzle on my NAS because it’s built in a way that allows me to read logs easily, without getting distracted by extra features, and troubleshoot issues more efficiently. It’s a window into my containers when something breaks and requires me to implement a fix quickly. Note: Install Dozzle on Your Synology NAS.
Formbricks is a solution for in-product micro-surveys that promises to supercharge your product experience. Formbricks provides a free and open source surveying platform. Gather feedback at every point in the user journey with beautiful in-app, website, link and email surveys. Note: Install Formbricks on Your Synology NAS.
Flare is a modern, self-hostable file sharing platform designed to work seamlessly with popular screenshot and sharing tools like ShareX and Flameshot. Built with Next.js and designed with simplicity in mind, it offers a complete solution for all your file sharing needs, with a strong focus on performance, customizability, and user experience. I’ve been using Flare for a few months now as my daily file-sharing tool on my Synology NAS, and it has completely replaced the clunky solutions I relied on before. The seamless integration with ShareX and Flameshot makes uploading screenshots effortless, the interface feels clean and modern, and the performance has been rock-solid even with larger files. Note: Install Flare on Your Synology NAS.
Reactive Resume V6 is a free, open-source resume builder that lets you create, update and share professional resumes and cover letters with no ads, no tracking and no paid tiers. You write on one side of the screen and see the finished page update in real time on the other; then you can export as PDF, Word, Markdown or JSON, or share it with a public link via your own domain name or DDNS. With the jump from v5 to v6, the whole app has been redesigned. The separate Resumes and Cover Letters dashboards are now a single Documents library, the editor is split into three focused modes (Write / Design / Check), the old Agents system has been replaced by an in-editor AI assistant that only proposes changes you approve, and a new PDF engine (Forme) makes the live preview match the downloaded file exactly. Cover letters are now standalone documents and the job-application tracker has been rebuilt around List, Board, Insights and Calendar views. I self-host the latest version on my Synology NAS with Docker so I keep full control of my data and always have the newest features available locally. Note: Install Reactive Resume V6 on Your Synology NAS.
Degoog is a modern, self-hosted search engine aggregator that lets you search multiple engines at once and view all results in a single clean, unified interface. It acts as your personal meta-search engine, forwarding queries to your chosen providers, combining the results, and delivering them without tracking or ads for full privacy. What sets it apart is its extremely powerful and flexible plugin system: you can add custom search engines, bang commands, dynamic slot plugins that insert panels based on your query, custom transports to bypass anti-bot protections, themes, aliases, user settings, and a full store for official and community extensions. It’s built as a lighter, more modular alternative to SearXNG. It is actively developed in beta, fully open source under AGPL-3.0 license. Note: Install Degoog on Your Synology NAS.
ArchiveBox is a powerful, self-hosted internet archiving solution to collect, save, and view sites you want to preserve offline. You can feed it URLs one at a time, or schedule regular imports from browser bookmarks or history, feeds like RSS, bookmark services like Pocket/Pinboard, and more. It saves snapshots of the URLs you feed it in several formats: HTML, PDF, PNG screenshots, WARC, and more out-of-the-box, with a wide variety of content extracted and preserved automatically (article text, audio/video, git repos, etc.). The goal of ArchiveBox is to sleep soundly knowing the part of the internet you care about will be automatically preserved in durable, easily accessible formats for decades after it goes down. I first discovered ArchiveBox when I started losing access to research articles and blog posts I relied on for work links. Setting it up on my Synology NAS changed everything: I now feed it URLs from my browser history and RSS feeds, and it quietly captures full HTML, PDFs, screenshots, and WARC files. Knowing those pages are safely archived offline in multiple durable formats finally lets me sleep soundly. Note: Install ArchiveBox on Your Synology NAS.
💡RomM
RomM is a self-hosted application for organizing and playing retro game collections through a clean, responsive web interface, ideal for emulator enthusiasts. It scans and enriches your game library with metadata from IGDB, Screenscraper, and MobyGames, supporting over 400 platforms, and fetches custom artwork from SteamGridDB. You can play games directly in the browser using EmulatorJS and RuffleRS, share your library with customizable permissions, and manage games (view, upload, update, delete) from any modern browser. RomM supports multi-disk games, DLCs, mods, patches, manuals, and custom tags for filtering. It integrates with Playnite and muOS, and displays RetroAchievements. Note: Install RomM on Your Synology NAS.
Snipe-IT is a free, open source IT asset management system written in PHP. Snipe-IT was made for IT asset management, to enable IT departments to track who has which laptop, when it was purchased, which software licenses and accessories are available, and so on. I’ve been using it for a couple of years now to keep track of my own growing collection of devices, software licenses, and network gear at home. What started as a simple way to stop losing track of which laptop had which warranty quickly became indispensable. Now I can see at a glance who *owns* what, when something is due for replacement, and which licenses are still available. Note: Install Snipe-IT on Your Synology NAS.
Floppy is a self-hosted, all-in-one media tracker and personal media diary that serves as a broader alternative to Trakt, Letterboxd, and TV Time. It unifies tracking for movies, TV, anime, manga, books, comics, games, board games, music, and podcasts into one library, history, and set of stats, with features like progress views, recap-style statistics, shareable lists, owned-media collections, and live integrations that keep your data private on your own hardware. Note: Install Floppy on Your Synology NAS.
Web-Check will help you get an insight into the inner-workings of a given website: uncover potential attack vectors, analyze server architecture, view security configurations, and learn what technologies a site is using. Currently the Web-Check dashboard will show: IP info, SSL chain, DNS records, cookies, headers, domain info, search crawl rules, page map, server location, redirect ledger, open ports, traceroute, DNS security extensions, site performance, trackers, associated hostnames, carbon footprint. The aim of Web-Check is to help you easily understand, optimize and secure your website. Note: Install Web-Check on Your Synology NAS.
Plane is an open-source software development tool to manage issues, sprints, and product roadmaps with peace of mind. It allows users to start with a basic task tracking tool and gradually adopt various project management frameworks like Agile, Waterfall, and many more. My personal experience with Plane: clean, modern UI and solid self-hosted performance felt lighter and more focused than most alternatives I’ve tried. I use Plane to manage personal side projects and small team sprints directly from my Synology NAS, keeping everything private and offline-capable without relying on cloud tools. Note: Install Plane on Your Synology NAS.
Homarr is a simple and lightweight homepage for your server that helps you easily access all of your services in one place. The thing I like most about Homarr is its speed and simplicity in adding links of your favorite docker apps. You can use it as a bookmark as well. It has great integration with Plex, Sonarr, Radarr, Pi-Hole etc. Homarr supports multiple configs and persistent storage. Running Homarr on my Synology NAS has helped me integrate all the apps I use daily into a clean and simple dashboard. I find it useful that I only have to configure my settings once, and the persistent storage feature allows me to return to the same configuration every time I open my Homarr setup. Note: Install Homarr on Your Synology NAS.
Sync-in is a secure, open-source platform for file storage, sharing, collaboration, and synchronization, giving users full data control through self-hosted infrastructure. It ensures privacy with no tracking or telemetry and offers granular permission management for users and groups at space and file levels. The platform supports cross-device synchronization with native desktop clients for Windows, macOS, and Linux, real-time collaborative document editing via OnlyOffice integration, and organized, secure spaces for personal, team, or public use. Files can be shared with specific users, groups, or via time-limited public links. It includes server-side full-text indexing for fast content search, activity history with notifications, and WebDAV support to mount spaces as remote drives. Note: Install Sync-in on Your Synology NAS.
JellyGlance is a modern, self-hosted dashboard for Jellyfin media servers that unifies live sessions, user statistics, recently added media, libraries, download queues, release calendars, webhooks, backups, request management, and integrations with tools like the Arr suite, Seerr apps, and download clients into one clean, customizable command center. Note: Install JellyGlance on Your Synology NAS.
This post was updated on Friday / October 30th, 2026 at 12:02 PM