What happened
Synology warned on October 29 that attackers were exploiting a vulnerability fixed in December 2024 against network-attached storage devices still running outdated versions of its DiskStation Manager operating system. The company said the attacks seek to encrypt stored data and demand ransom. Its notice directs users to security advisory Synology-SA-24:20 and recommends immediate upgrades and automatic updates. The Hacker News independently reported the incident on November 3, explaining that the older advisory lists three different weaknesses affecting DSM components. These include a remote-code-execution flaw, a limited file-reading flaw and an update-certificate-validation flaw. Crucially, Synology has not publicly identified which specific flaw is being exploited in the current attacks. Reports from affected users also describe encrypted files and a C3RB3R-themed ransom demand, but those observations do not establish the entry point for every incident.
Why it matters
The case illustrates why a security patch does not eliminate risk when devices remain on obsolete software. NAS appliances often hold backups, shared documents or operational records, so encrypting them can interrupt both recovery and everyday work. A network storage device may also receive less routine attention than a laptop or server, especially when it was installed years earlier. Synology's disclosure supports an active exploitation warning, not a precise victim count or proof that every DSM release is exposed. It is also important not to confuse this older exploited issue with the separate PHP2Shell updates discussed in the company's other October announcement. Both are patch-management concerns, but the available evidence does not establish that they are the same attack chain.
What to watch next
Administrators should identify the DSM version on each Synology device, compare it with the vendor's supported fixes and apply the appropriate updates. They should also review access exposure, account activity, backup integrity and signs of encryption rather than treating a completed upgrade as proof that no compromise occurred earlier. Systems too old to receive supported security updates deserve particular attention. Watch for a vendor clarification of the exploited CVE, independently documented intrusion techniques and any verified scope of affected installations. Until those details emerge, the defensible conclusion is narrow: active attacks are occurring against outdated DSM installations, while the exact exploited weakness remains unspecified.