On Thursday, October 29, 2026, Synology issued a notice advising users to update DSM after a series of ransomware attacks targeting NAS machines still running outdated operating system versions, and the key point is that the attack group is exploiting a vulnerability that the company has patched since December 2024, not a new "super vulnerability" that has not yet been patched.

Simply put, this is the type of attacker who takes over, encrypts all of our data, then demands ransom, and must prevent being caught up in wrongful loss of money early.

Yesterday's Synology press release.

What is Ransomware?

Ransomware is a form of ransomware: software that infiltrates a computer or storage device, encrypts the user's files (photos, documents, videos, backups...) so that the person cannot open them again, then displays a notice demanding a ransom if they want the data back.

Unlike viruses that only destroy computers for fun or mine coins, ransomware targets valuable data directly, because losing data means losing work, memories or losing company operations, so many victims are easily forced to pay, while paying does not guarantee file recovery and also encourages the attacker to continue doing this.

With a NAS like Synology, the risk is a bit greater than a personal computer, because the NAS often contains photo libraries, computer backups, shared work files, and if the device has an open port to the Internet or the DSM has not patched the vulnerability, an attacker may not need to sit in front of your computer to remotely attack.

Even in the age of AI, NAS is also a data center, a personal server, runs web apps and so on... in general, it is much more dangerous than a personal computer.

What's up with Synology in this?

According to Synology's Vietnamese announcement on October 29, 2026, the company has identified threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM, with the goal of data encryption and extortion.

The company cited additional security advisory Synology-SA-24:20 (also known as DSM Pwn2Own 2024), in which the most serious vulnerability published in detail is CVE-2024-10441, Critical level with CVSS score 9.8, allowing remote attackers to execute arbitrary code if the machine is still under the corresponding patch.

In addition, advisory also noted CVE-2024-50629 (limited file reading) and CVE-2024-10445 (limited file writing in the update context), but the point you need to remember most is still to upgrade DSM to the correct patched version, because the company clearly states that there is no alternative mitigation measure other than updating.

Why did the company write it? I'll note it down for you guys to read, but I don't understand what it is.

Advertisement

What does the company want you to do?

Synology strongly recommends that all users running vulnerable versions update DSM immediately to protect their systems, and recommends enabling automatic updates to keep DSM at the latest version. Detail

here.

According to the affected products table in Synology-SA-24:20, the minimum level you need to achieve (or higher on the same DSM branch) is as follows:

• DSM 7.2.2: upgrade to 7.2.2-72806-1 or higher
• DSM 7.2.1: upgrade to 7.2.1-69057-6 or higher
• DSM 7.2: upgrade to 7.2-64570-4 or higher
• DSM 7.1: upgrade to 7.1.1-42962-7 or higher
• DSM 6.2: upgrade to 6.2.4-25556-8 or higher

In fact, you don't need to remember each build number if you are used to updating regularly, because you just need to go to DSM, open Control Panel → Update & Restore, check for new versions and install, then turn on automatic updates so you don't forget next time.

If you want to download the DSM version according to the correct device model, go to Synology's Download Center, select your DiskStation / FlashStation product line, then download the corresponding DSM package instead of guessing by hand on a strange network.

Advertisement

In addition to updating, you should tighten up a few habits

Updating DSM is a mandatory step in this case, but you should still limit opening the DSM interface or SMB port directly to the Internet if not really needed, and prioritize remote access via VPN or the company's relay/QuickConnect mechanism instead of forwarding the administrative port on the router. In addition, you should turn on a firewall that only allows trusted IPs, turn on two-step authentication, turn off or change the default admin account, turn on automatic IP blocking when logging in repeatedly, and keep a snapshot of the shared folder and at least one offline backup or a backup that the infected NAS cannot overwrite.

If you see a strange file, a note demanding money, or the NAS suddenly becomes unusually slow with a series of files that cannot be opened, the first thing to do is disconnect the device from the network to stop the encryption process, keep the log and note files if any, then restore from a clean backup instead of hastily paying the ransom without a clear basis.

In short, don't let the NAS go on the internet, secondly, unplug the network cable if in doubt. Update according to Synology's instructions and then turn it back on.

According to:

Synology 1

2

3

4