Synology Calendar and PHP Memory Corruption Flaws

What happened

Synology's advisory identifies memory corruption vulnerabilities affecting Synology Calendar, Mail Station and multiple PHP packages. Think of request memory as a desk cleared between customers: these flaws can leave software consulting unfinished notes or information that should already have been discarded. The resulting mistakes can lead to remote code execution, meaning an attacker could cause the affected software to run code.

The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. NVD published both entries on 2026-10-21 and lists each as CRITICAL with a CVSS 4.0 score of 9.2. Synology's affected-version table gives the same update thresholds for both vulnerabilities, although their underlying memory-handling problems differ.

Both vulnerabilities are known to be exploited: CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-26. The catalog lists a due date of 2026-10-29 and identifies known ransomware use as Unknown; that status does not establish whether ransomware has been involved. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-29.

Technical details

Both vulnerabilities involve memory corruption, where software handles memory in ways that can undermine its intended behavior. NVD associates both entries with CWE-1325, Improperly Controlled Sequential Memory Allocation; CWE-416, Use After Free; CWE-755, Improper Handling of Exceptional Conditions; and CWE-824, Access of Uninitialized Pointer. These classifications describe related memory and error-handling weaknesses, rather than separate vulnerabilities requiring separate updates.

CVE-2026-109618 concerns PHP's response to an out-of-memory condition, which occurs when an allocation cannot obtain the memory it needs. PHP uses longjmp() to leave the current execution context and stop processing the request. Some execution contexts do not fully accommodate that exit, allowing memory associated with the request to remain uninitialized. During cleanup, PHP can consult that memory or let its contents influence execution. NVD describes multiple ways to trigger the out-of-memory condition and reach remote code execution.

CVE-2026-109619 concerns global state, information that can remain available across requests. Some of that state temporarily references memory belonging to an individual request. If those references are not cleared correctly, or are restored after clearing, they can survive after the referenced memory has been freed. A later request can then consult the stale information before initialization is complete. NVD describes multiple ways to trigger this condition and achieve remote code execution.

The described attack conditions involve reaching the affected PHP behavior: out-of-memory handling for CVE-2026-109618 and stale references to freed request memory for CVE-2026-109619. The descriptions do not establish authentication requirements, a particular exposed endpoint or a specific package configuration needed for exploitation. The CVSS 4.0 score of 9.2 communicates critical technical severity; it does not measure the likelihood that a particular installation has been attacked. CISA's KEV listings separately establish known exploitation.

Weakness types: Memory corruption

Who is affected

Everyday users

For everyday users, the practical task is to check whether Synology Calendar, Mail Station or an affected PHP package is installed and below its listed fixed version. You do not need to write PHP code to have an affected package: Synology lists Calendar and Mail Station themselves in the advisory.

The potential outcome is more serious than an application error because the vulnerabilities can lead to remote code execution. However, an affected version alone does not prove that someone has accessed your system. If someone else manages your Synology installation, ask them to confirm the installed package versions and complete the relevant updates.

Developers

Developers using the listed Synology PHP packages should check the complete package version, including the suffix after the hyphen. The advisory distinguishes PHP packages by release branch and, for PHP 7.4 and PHP 8.0, by DSM version. Matching only the PHP branch is insufficient to determine whether the installed package meets the fixed threshold.

These vulnerabilities arise in PHP's handling of request memory and execution state. The advisory's stated remedy is to update the affected package or migrate away from PHP 7.3 to a fixed release. Treat that migration as a compatibility change for applications that depend on the old runtime, and verify their normal behavior afterward.

Server and IT admins

Server and IT administrators should inventory every listed package in use and match it to the appropriate advisory entry. Calendar, Mail Station and the PHP packages have distinct version thresholds. For PHP 7.4 and PHP 8.0, the DSM branch also determines which package build is fixed.

Known exploitation makes remediation a priority for affected installations. Record the installed versions, apply the corresponding updates and confirm the resulting versions afterward. The KEV due date of 2026-10-29 is a catalog entry; it should not be presented as a universal deadline for every Synology user.

What to do now

1. Identify installed copies of Synology Calendar, Mail Station and the listed PHP packages. Record each complete package version and the applicable DSM branch so you can compare it with the correct advisory entry.
2. Update Synology Calendar versions earlier than 3.0.4-21435 to 3.0.4-21435 and later. Update Mail Station versions earlier than 30000002.3.19-20333 to 30000002.3.19-20333 and later. Follow the update steps in the vendor's advisory.
3. Migrate PHP 7.3 to a fixed release. Synology lists All versions as affected and gives migration as the action, rather than identifying a fixed PHP 7.3 package. Check application compatibility as part of that migration.
4. For PHP 7.4 (DSM 6.2), update versions earlier than 7.4.33-0010 to 7.4.33-0010 and later. For PHP 7.4 (DSM 7.0 ~ 7.1), update versions earlier than 7.4.33-0122 to 7.4.33-0122 and later. For PHP 7.4 (DSM 7.2 and later), update versions earlier than 7.4.33-0131 to 7.4.33-0131 and later.
5. For PHP 8.0 (DSM 7.0 ~ 7.1), update versions earlier than 8.0.30-0104 to 8.0.30-0104 and later. For PHP 8.0 (DSM 7.2 and later), update versions earlier than 8.0.30-0122 to 8.0.30-0122 and later.
6. Update PHP 8.1 versions earlier than 8.1.34-0120 to 8.1.34-0120 and later. Update PHP 8.2 versions earlier than 8.2.35-0171 to 8.2.35-0171 and later.
7. Update PHP 8.3 versions earlier than 8.3.36-0051 to 8.3.36-0051 and later. Update PHP 8.4 versions earlier than 8.4.27-0051 to 8.4.27-0051 and later. Follow the update steps in the vendor's advisory for each applicable PHP package.

If you can't update yet

• If an update must wait, check the vendor advisory for guidance on restricting access to affected services and reducing their internet exposure. Treat access restrictions as temporary risk reduction while arranging the applicable update or migration.

How to confirm the fix

• Check the complete installed version of every affected package against its corresponding fixed threshold. For PHP 7.4 and PHP 8.0, confirm that the comparison uses the entry matching the installation's DSM branch.
• For PHP 7.3, confirm that affected use has been migrated to a fixed release. The advisory does not list an in-branch fixed version.
• Confirm that Synology Calendar, Mail Station and applications using updated PHP packages still perform their normal tasks after the changes.
• Record the resulting versions and migration outcome. Meeting the listed thresholds confirms the version-based remediation for both CVEs; it does not establish whether exploitation occurred before the update.

NVD scores and CISA KEV status

Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-109618 (added October 26, 2026), CVE-2026-109619 (added October 26, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.

Affected products and fixed versions 24 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Synology advisory: https://www.synology.com/ko-kr/security/advisory/Synology_SA_26_14
• NVD: CVE-2026-109618
• NVD: CVE-2026-109619
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 29, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.