PHP2Shell: Important Security Information for QNAP NAS and MOBOTIX NAS Used with MxManagementCenter
Security Information | October 23, 2026
Following the recent disclosure of the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), MOBOTIX would like to inform customers about the potential impact on NAS recording systems used in combination with MxManagementCenter (MxMC).
These vulnerabilities affect, among other products, the QNAP QTS operating system, which is used by various QNAP NAS devices as well as the originally offered MOBOTIX NAS recording systems.
On October 22, 2026, QNAP published Security Advisory QSA-26-18, providing information about affected software versions and recommended security measures.
The PHP2Shell vulnerabilities are classified as critical and could allow unauthenticated remote attackers to execute arbitrary code on affected systems.
1. Customers Using QNAP NAS as a Recording Device for MxManagementCenter
Customers using a QNAP NAS with QVR Pro or as a file server for recording MOBOTIX cameras should review and follow the latest QNAP security recommendations.
According to QNAP, the affected operating system versions include:
-
QTS 6.1.0
-
QTS 5.2.11 and earlier
-
Various versions of QuTS hero and other QNAP products
QVR Pro is not explicitly listed as an affected product in the current QNAP security advisory. However, since QVR Pro operates on the underlying QNAP operating system, the NAS device itself may still be affected through its operating system.
MOBOTIX therefore recommends that all customers check their installed QNAP operating system version and regularly review QNAP security advisories and available software updates.
Official QNAP Security Advisory:
QNAP Security Advisory QSA-26-18 – PHP2Shell
2. Customers Using an Original MOBOTIX NAS
The MOBOTIX NAS was offered as an OEM product based on QNAP technology, using a customized version of the QTS operating system together with QVR Pro recording software.
The MOBOTIX NAS product line was officially discontinued (End of Life) in 2022. Since then, no further feature development has been provided for the original MOBOTIX-specific NAS software.
To allow existing customers to continue benefiting from current software versions and security updates, MOBOTIX made a free software upgrade available in October 2023.
This upgrade converts an existing MOBOTIX NAS into a fully functional QNAP NAS running the official QTS operating system and QVR Pro software.
MOBOTIX strongly recommends that customers still operating an original MOBOTIX NAS with MOBOTIX-specific software, who have not yet performed the upgrade, migrate to the official QNAP software in coordination with their MOBOTIX partner.
Once the upgrade has been completed, supported QNAP software versions and security updates can be obtained directly from QNAP for the respective NAS model.
Important: The upgrade cannot be reversed. Customers should therefore carefully review the upgrade requirements and perform the necessary data backups before starting the migration.
Detailed information and step-by-step instructions are available in the MOBOTIX Community:
MOBOTIX NAS – QNAP Upgrade (English Instructions)
Official MOBOTIX NAS QNAP Upgrade Release Notes (English)
MOBOTIX NAS QNAP Upgrade – Software Download
MOBOTIX – NAS Solutions with QNAP
After upgrading to the official QNAP software, customers must also follow the current QNAP security advisories, particularly regarding the PHP2Shell vulnerabilities and the availability of corresponding security updates.
3. Recommended Security Measures for QNAP and MOBOTIX NAS Systems
Until QNAP provides corrected software versions, the following protective measures are strongly recommended:
-
Avoid exposing the NAS directly to the internet. Disable unnecessary port forwarding and UPnP functions on the router.
-
Use a secure VPN connection for remote access. NAS management interfaces should not be directly accessible from the internet.
-
Restrict network access to trusted devices and networks. Configure appropriate firewall rules and access restrictions to limit access to authorized systems.
-
Disable unnecessary services and applications. Review additional web services and applications and disable those that are not required.
-
Regularly check the system for suspicious activity. QNAP recommends reviewing system logs and using the available security tools to identify potential security incidents.
These measures can reduce the risk of exploitation but do not eliminate the underlying vulnerabilities.
The complete and most up-to-date security recommendations are available in the official QNAP security advisory:
QNAP – PHP2Shell Security Advisory and Mitigation Measures
4. Availability of Security Updates
As of October 23, 2026, QNAP is actively working on resolving the PHP2Shell vulnerabilities. Fixed software versions have not yet been announced.
MOBOTIX therefore recommends that all customers using a QNAP NAS or a former MOBOTIX NAS upgraded to the official QNAP software regularly check the QNAP security advisory for new information and the availability of corrected software versions.
As soon as QNAP releases the corresponding security updates, these should be installed promptly.
Customers should ensure that the respective firmware or software version is officially supported by their specific NAS model.
Additional Information and Downloads:
QNAP Security Advisory QSA-26-18
QNAP Download Center – Firmware and Software Updates
Final Recommendation
MOBOTIX generally recommends keeping video recording systems up to date with the latest available security updates and avoiding direct internet exposure of NAS management interfaces.
The PHP2Shell vulnerabilities described above do not affect the MxManagementCenter software itself, but may affect the operating system of the NAS devices used for video recording.
MOBOTIX will continue to monitor the situation and provide further information if new relevant security findings become available.