Synology Ransomware Warning: You Can't Patch a NAS You Haven't Found

How to find every Synology NAS on your network, see which DSM version it reports, and check whether that release is still supported.

In October 2026, Synology issued a warning: attackers are targeting NAS devices running outdated DiskStation Manager (DSM). The exploited vulnerability was patched back in December 2024 (SA-24:20), and the ransomware, called C3RB3R, encrypts files and demands a ransom. Other security vendors point to several different DSM vulnerabilities as the entry point, so the safest approach is simple: bring DSM fully up to date.

But before doing that, there's a prerequisite: you need to know exactly which devices you have.

Do you remember how many NAS you have?

Storage devices in homelabs and small offices tend to pile up: the main Synology, an older DiskStation for backups, one in another room, and one you said you'd unplug but never did. Some may not have been logged into for a year, and older models can't all run the latest DSM. Some models top out at DSM 7.4, so "the latest version" depends on the model.

Checking by hand means finding each device's IP, logging in to DSM, and opening the software info page. That's fine for one device, but across a whole network it becomes an inventory job.

What's the most convenient way? Scan first

WiFi Health Check is an iPhone app that scans the Wi-Fi network you're connected to and lists the devices on it. Many Synology NAS units announce themselves over multicast discovery protocols, and when one does, the app can read the model and DSM build the NAS reports about itself, for example a DS920+ running DSM 7.1-42962.

If a NAS doesn't announce itself (multicast discovery is disabled, or the device sits behind VLAN isolation), you'll see a Synology device with the model or version marked "unknown." That's a prompt to check inside DSM. It's a low-probability event, unless your Synology NAS is very old.

For versions it can read, the app also shows whether that DSM release is still within Synology's published support window. Under Synology's lifecycle policy, DSM 7.2 maintenance ended in December 2025, extended support for DSM 7.1 on eligible hardware ended in June 2025, and DSM 7.4, released in June 2026, is maintained through June 2028. Devices running on a branch that's out of support will have to rely on other means of protection.

An example of a practical workflow: first, run a scan, and you'll get an overall report and a list. Fully identified devices appear in it, and your Synology devices are among them. For those that meet the detection conditions, you can go straight to the Synology detail page in the app and view the lifecycle card and recommendations. For those that don't meet the conditions, you'll get a separate-style Synology list, but the specific version numbers need to be looked up manually.

This last step is critical. Once you have the product identification report, the next step is to apply patch updates and security hardening as needed. That's the purpose of the scan: to let you know where you stand ahead of time. WiFi Health Check is a discovery and diagnostic tool; Synology's updates and security protections are the steps that follow.

Then check the basics

Once you know what's on your network:

• Install the latest DSM security updates, and turn on automatic updates if possible.
• Don't expose the DSM management interface to the internet.
• Disable the default administrator account and enable two-factor authentication.
• Run Synology's Security Advisor.
• Keep at least one verified backup that ransomware can't reach.

The recent PHP2Shell advisories (SA-26:13) involve specific PHP-based packages. Synology's ransomware warning points to SA-24:20, so please treat the two as separate issues.

For a homelab or small office, this is enough to answer a basic question: what's on my network, and which of it needs attention? Windows, Mac, Ubuntu? The product lifecycles of all these systems can be correctly identified.

Next, if you want to know which cameras or NVRs exist on your network, you can also use WiFi Health Check.

As for the tiers of information and reports, this is a boundary worth knowing: it separates the FREE tier from the PRO tier. It's a tier of information density, not a technical ceiling, and you're free to choose.

APPStore: https://apps.apple.com/app/wifi-health-check/id6791147190