NAS security · Practical guide · 6 November 2026 · Updated 11 November 2026
Which NAS models no longer get security updates?
Your old NAS still works. Its maker may have stopped fixing it anyway. Find your Synology or QNAP model in our tables, checked 6 November 2026, and see what to do next.
Viktor (Dante) BurcevskiWildfire Data Recovery · IACIS CFCE 6 November 2026 · 34 min read · 67 references
AI-generated illustration. A NAS can keep running for years after its maker stops fixing it. No real device, brand or client is depicted.
When a NAS stops getting security updates, every flaw found in it from then on stays open.
C3RB3R shows how this plays out. On 29 October 2026, Synology warned that attackers are exploiting a flaw it patched in December 2024 against NAS units running outdated versions of DSM, its NAS operating system, and told owners to update now and turn on automatic updates. [1] That time, the fix reached every DSM branch Synology listed, even the older DSM 7.2, 7.1 and 6.2, so owners on those versions had something to install. [2]
Synology’s September 2026 advisory left those versions out. SA-26:13, published on 18 September 2026, is rated Critical and covers eight flaws. Three need no login, including the two rated Critical. It lists fixed builds for DSM 7.4, 7.3, 7.2.2 and 7.2.1 only. There is no fix for DSM 7.2, 7.1 or 6.2, and the advisory does not say whether those versions are affected. [3] A NAS that cannot move past one of them has no fix to install for these flaws. The next critical DSM advisory, SA-26:19, published on 10 November 2026, again lists fixed builds for DSM 7.4, 7.3, 7.2.2 and 7.2.1 only. Our C3RB3R guide covers a security firm’s claim that the attacks use these newer flaws, which Synology has not confirmed.
This guide covers how support ends, the Synology end of life and QNAP support dates for each version and model as at 6 November 2026, how to check yours, and what to do next. QNAP’s NAS software is called QTS or QuTS hero. Both makers publish their dates and model lists, so they get the most detail. Other brands get a short panel.
Three questions
Answer these three and you know where your NAS stands. Each one is explained below.
01 · MODEL
What model is it?
The model sets the newest software the NAS can ever run, however well it still works. How to find it
02 · VERSION
What version is it running?
The exact build matters. “DSM 7” or “QTS 5” is not enough to tell. How to find it
03 · SUPPORT
Is that version still supported?
Compare it with our tables, then confirm it on the maker’s own status page. See the tables
The short answer, as at 6 November 2026
Synology 15 series or older (the last two digits of the model number are 15 or lower, such as the DS415+, DS414, DS215j or DS412+), plus the DS216se: these models stop at DSM 7.1 or older, and Synology’s status page shows them as End of Life. Plan to replace them. [4][5]
Any Synology still on DSM 7.2 (build 64570), 7.1 or 6.2: there is no DSM fix for Synology’s 2026 critical DSM advisories. [3]
Most Synology 16 to 19 series models (such as the DS216j, DS218+ or DS918+): still supported, but DSM 7.4 is their last version. On Synology’s published dates, fixes would end around mid-2028 (our projection). [4][6]
Synology 20 series and newer (such as the DS220+, DS920+ or DS923+): full support, with no last version listed yet. [5][4]
QNAP on anything older than QTS 5.2 or QuTS hero h5.2: past QNAP’s published end dates. Some models on QTS 5.2 are also past their security end date, so check yours. [7][8]
Why old and unpatched NAS units are the ones that get hit.
AI-generated illustration. Attackers aim at the NAS units that missed a fix or can no longer get one.
NAS attacks keep landing on units that missed a fix, or could never get one. The makers’ own advisories show the pattern.
NAS attacks on old or unpatched units, and what the maker said
Attack
Which units
What the maker said
2021 · My Book Live (Western Digital)
My Book Live and My Book Live Duo units, which WD says got their final firmware update in 2015.
Units connected to the internet were being compromised through multiple vulnerabilities, in some cases with a factory reset that appears to erase all data. WD told owners to disconnect them from the internet immediately. [9]
2022 · DeadBolt (QNAP)
QNAP said the campaign appeared to target outdated QTS 4.2.x, 4.3.x and 4.4.x, and that QTS 4.5.x and 5.x were not affected. [10]
QNAP named fixed builds for some 4.2 and 4.3 versions and told QTS 4.4.x owners to move to 4.5.x or 5.x. [10] Earlier that year it had listed QTS 4.2.6, 4.3.3, 4.3.6 and 4.4.1 as the last versions some end-of-life models can run, with only high or critical fixes, extended until October 2022. [11]
2024 · DNS-series NAS (D-Link)
Twenty legacy models past their end-of-service dates, 17 of them DNS-series NAS units such as the DNS-320L, DNS-325, DNS-327L and DNS-340L. [12]
No patch. D-Link said products past end of life no longer get software updates or security patches, and recommended retiring and replacing every one. [12] GreyNoise reported the flaw being exploited in the wild. [13]
2026 · C3RB3R (Synology)
Devices running outdated versions of DSM.
A flaw patched in December 2024. Update now and turn on automatic updates. [1]
Some of the QTS versions DeadBolt went after were the last versions certain older QNAP models could run. That link is our reading of the two QNAP pages, not a QNAP statement.
A published fix is a map
Every security update comes with a note saying what was fixed and in which builds. In our view, that tells attackers which older versions are worth trying, just as it tells owners what to install. The Australian Signals Directorate (ASD) says AI is shortening the time between a flaw being found and being exploited, [14] and that it keeps seeing incidents caused by unpatched vulnerabilities, including one first identified in 2008. [15] The flaw behind C3RB3R had a fix available for almost two years before Synology reported the attacks. [1]
Unsupported means the hole never closes
On a supported NAS, the window closes when you install the update. On an unsupported one there is usually nothing to install. ASD says the risk of a cyber security incident is much higher once a product reaches end of support. [16]
Why Australian businesses should care
ASD’s Australian Cyber Security Centre (ACSC) responded to 139 ransomware incidents in 2025-26. [15] First on ASD’s list of five Cyber Action Year actions is to replace or mitigate legacy technology: hardware and software that no longer gets important security updates from its maker. [17] ASD’s Essential Eight asks, from its first maturity level, that unsupported operating systems are replaced, [18] and ASD’s Information Security Manual (ISM) says the same of unsupported networked IT equipment, with compensating controls until then. [19] ASD names no NAS units in these; applying them to a NAS is our reading.
How support ends
How support ends, one step at a time.
AI-generated illustration. Support for each software version steps down from full fixes, to security fixes only, to a red light with no fixes at all.
NAS makers rarely switch support off in one go. Each software version steps down through stages, and each brand has its own names for them. In plain words there are three.
Support stages in plain words, and what Synology and QNAP call them
In plain words
Synology
QNAP
Full support
“Full” on the status page: firmware and software updates continue. [5] In Synology’s life-cycle policy, a DSM version is in its Maintenance phase from release until its end-of-maintenance date. [6]
Production phase: full support, with feature updates and fixes. [7]
Security fixes only
“Limited” on the status page: security updates only. [5] In the policy, the Extended Life phase, offered only for selected long-term support (LTS) versions, brings critical security fixes only. [6]
Maintenance phase: critical security updates and essential bug fixes. LTS phase: critical security updates and major stability fixes only. [7]
End of life
“End of Life”: no more firmware, software or security updates. [5]
Security patches stop when maintenance ends, unless the version has LTS. For an LTS version, the end of LTS is the end of life. [7]
Synology’s status page also has a Technical Support column that uses the word “Limited”. It is about help from Synology, not software updates, so ignore it when judging fixes. [5]
The NAS keeps working
End of life does not switch anything off. The NAS keeps serving files exactly as before, which is why it is easy to miss. When DSM 6.2 reached the end of its extended life on 1 October 2024, Synology said it would get no more functionality, security or package updates, and that DSM 6.2 downloads would stay available. [20] Synology has since made exceptions, covered below. QNAP notes that only the latest QTS contains fixes for all security issues, and that earlier versions do not get every fix. [8]
The software has an end date
Synology treats each minor version, such as DSM 7.2, as a separate product with its own dates, and every DSM major version has at least one long-term support version. It calls its future dates close approximations that may be extended. [6] QNAP publishes the same kind of dates for each QTS and QuTS hero version. [7]
The model has a last version
Each model can only run software up to a certain version. Synology’s list puts that at DSM 7.4 for the 16 to 19 series models it lists (except the DS216se), DSM 7.1 for the 14 and 15 series and part of the 13 series, and DSM 6.2 for the 11 and 12 series and the rest of the 13 series. [4] QNAP’s status page shows a last version for some models, such as QTS 4.3.6 for the TS-431. [8]
When a model’s last version reaches its end date, the model is out of support, however well it runs. The DS414 cannot go past DSM 7.1, [4] DSM 7.1’s extended life ended in about June 2025, [6] and Synology’s status page now shows the DS414 as End of Life. [5]
Dates are approximate, and patches sometimes come late
Synology has shipped a final patch after a stated end date more than once. DSM 7.1.1-42962 Update 9 came out on 5 August 2025, after DSM 7.1’s June 2025 end, [21] and DSM 6.2.4-25556 Update 8 came out on 3 December 2024 (Synology added it to SA-24:20 two days later), two months after DSM 6.2’s extended life ended. [22][2] Most recently, between 22 and 31 October 2026, Synology released Critical fixes for PHP, Synology Calendar and Mail Station through Package Center for DSM 7.2, 7.1, 7.0 and even 6.2, two years past its end date. These were package updates, not DSM updates, and they do not fix the SA-26:13 or SA-26:19 flaws. [23][24] That is what we observed, not Synology policy, so do not plan around it. ASD also warns that some equipment may stop getting support as soon as a newer version is released. [19]
Out of support now
What is out of support now.
These tables come from the makers’ own pages, read on 6 November 2026. Synology and QNAP change those pages without notice, so treat the tables as a snapshot and confirm your model on the maker’s page. Synology builds are written the way DSM shows them under Control Panel, Info Center.
Synology end of life: DSM versions · Checked 6 November 2026
Synology DSM versions, Synology’s dates, newest builds and status, checked 6 November 2026
DSM version
Synology’s dates
Newest build we found
Where it stands
DSM 7.4
Released June 2026. Maintenance to about June 2028. No extended life.
7.4.1-90080 Update 1, 12 Oct 2026
Supported. 7.4.1 is a micro release within DSM 7.4 under Synology’s versioning rules. [6]
DSM 7.3 (LTS)
Released October 2025. Maintenance to about October 2027, extended life to about October 2028.
7.3.2-86009 Update 5, 12 Oct 2026
Supported.
DSM 7.2.2
No row of its own. A micro release within DSM 7.2, so on paper maintenance ended about December 2025.
7.2.2-72806 Update 10, 12 Oct 2026
Updated 12 Oct 2026. Listed in SA-26:13 and SA-26:19, but Synology called DSM 7.2 end-of-life in late October 2026. [3][23]
DSM 7.2.1
No row of its own. A micro release within DSM 7.2, so on paper maintenance ended about December 2025.
7.2.1-69057 Update 13, 12 Oct 2026
Updated 12 Oct 2026. Listed in SA-26:13 and SA-26:19, but Synology called DSM 7.2 end-of-life in late October 2026. [3][23]
DSM 7.2 (build 64570)
Released June 2023. Maintenance ended about December 2025. No extended life.
7.2-64570 Update 4, 11 Feb 2025
No DSM update since February 2025. Not listed in SA-26:06, SA-26:13 or SA-26:19. [25][3]
DSM 7.1 (LTS)
Released April 2022. Maintenance ended about June 2024. Extended life ended about June 2025, for listed models only.
Dates come from Synology’s life-cycle policy, which calls them approximate. [6] Builds come from Synology’s release notes for the DS216j, and for the DS412+ in the case of DSM 6.2. [26]
Synology models · Checked 6 November 2026
Synology groups models by series, which is the last two digits of the model number: a DS918+ is an 18 series model and a DS415+ a 15 series model. Find your series below. [4]
Synology model groups, their last DSM version and status, checked 6 November 2026
Models (examples from Synology’s lists)
Last DSM they can run
Status page (DSM Update)
Newest build we found
20 series and newer
None listed yet. The DS220+, DS920+, DS923+ and other 20 series or newer models are not on Synology’s last upgradable version list. [4]
With the availability filter set to All, more than 120 DiskStation and RackStation models showed End of Life for DSM updates. Apart from the DS216se, all were from the 15 series or older. No NAS model was in the Limited, security-only tier. [5]
When do the 16 to 19 series models run out?
Synology has published no end dates for individual models. DSM 7.4 is the last version for most 16 to 19 series models, [4] and Synology’s policy gives DSM 7.4 an approximate end of maintenance of June 2028, with no extended life. [6] On those dates alone, these models would stop getting fixes around mid-2028. That is our projection, not a Synology statement, and Synology has patched past its stated dates before.
Why DSM 7.2.1 and 7.2.2 kept getting fixes when DSM 7.2 did not
Synology’s life-cycle policy treats each minor version as one product, and its date table has a single DSM 7.2 row, with maintenance ending in about December 2025 and no extended life. DSM 7.2.1 and 7.2.2 are later releases inside that product, with no rows of their own. [6] On paper, all of DSM 7.2 is past its end date.
In practice, Synology kept shipping DSM updates for the 7.2.1 and 7.2.2 branches through 2026, most recently on 12 October 2026, while the original 7.2 build, 64570, has had no DSM update since 11 February 2025, [26] and its 2026 DSM advisories, SA-26:06, SA-26:13 and SA-26:19, have no row for plain DSM 7.2. [25][3] Then, in a press release first issued on 22 October 2026 and last updated on 29 October, Synology itself described DSM 7.2 as end-of-life when it released PHP package fixes for it, without singling out 7.2.1 or 7.2.2. [23] That came within weeks of the latest 7.2.1 and 7.2.2 updates. Synology has not explained why 7.2.1 and 7.2.2 kept getting DSM updates, or said whether the October 2026 builds were the last, and it lists no model whose last version is DSM 7.2.x. [4]
Our reading: on DSM 7.2.1 or 7.2.2, install the latest update now, then move to DSM 7.3 or 7.4 as soon as you can. Synology already calls DSM 7.2 end-of-life, so the 12 October 2026 updates may be the last. On plain DSM 7.2 there are no DSM fixes, only occasional package fixes such as SA-26:14. [24] That matches our C3RB3R guide, which shows no fix for the 2026 flaws on DSM 7.2, 7.1 or 6.2.
QNAP QTS and QuTS hero · Checked 6 November 2026
QNAP QTS and QuTS hero versions, QNAP’s dates and status, checked 6 November 2026
Version
QNAP’s dates
Where it stands
QTS 5.2 (LTS) QuTS hero h5.2 (LTS)
Maintenance ended December 2025. LTS to August 2029.
LTS: critical security updates and major stability fixes only. Newest QTS build: 5.2.11.3661, published 24 Oct 2026. [28]
QuTS hero h6.0
No dates published yet.
Not yet in QNAP’s lifecycle table. Release notes for h6.0.0.3500 are dated 29 May 2026, and from h6.0.0 QuTS hero blocks firmware downgrades. [29]
QTS 5.1 QuTS hero h5.1
Maintenance ended November 2024. No LTS.
Ended.
QTS 5.0 QuTS hero h5.0
Maintenance ended September 2023. No LTS.
Ended.
QTS 4.5.4 (LTS) QuTS hero h4.5.4 (LTS)
LTS ended December 2025.
Ended.
QTS 4.4
Maintenance ended October 2020. No LTS.
Ended.
QTS 4.3 (LTS) QTS 4.2 (LTS)
LTS ended February 2024.
Ended. QNAP still posted some 4.3.3 and 4.3.6 builds on 1 July 2024 for older models. [30]
Dates come from QNAP’s operating system lifecycle table, which has no row yet for QuTS hero h6.0. [7]
QNAP models · Checked 6 November 2026
Selected QNAP models and their update status, checked 6 November 2026
Dates are QNAP’s, written out in full. The OS column shows when OS updates ended and the last version; the security column shows when limited support and security updates end or ended. [8] Firmware comes from QNAP’s Download Center. [28][30]
Reading QNAP’s page
Age alone does not tell you: older models such as the TS-251 still show Full and Active. Some models in QNAP’s end-of-life availability group, such as the TS-230 and TS-253D, still show security support to the end of 2027. Others, such as the TS-451A, TS-253Be and TS-453D, show OS updates Full even though their security support has ended. So go by the security column, not the availability label or the OS column. And the two QNAP pages do not always agree. The status page lists the TS-231P’s support as ending in 2023, yet the Download Center still offered it QTS 5.2.11 on 6 November 2026. [8][28] QNAP has not promised further fixes for it, so check both pages.
Other brands · Checked 6 November 2026
Western Digital My Cloud. Support for My Cloud OS 3 and earlier generations ended on 15 April 2022. [31] The original single-bay My Cloud (WDBCTLxxxxxxx-00), the My Cloud Mirror (WDBZVM, not the Gen2), the EX2 (WDBVKW) and the EX4 (WDBWWD) cannot run My Cloud OS 5. [32] WD says OS 5 itself will be supported at least until the end of 2026, and gives no later date. [33] The older My Book Live got its final firmware update in 2015. [9]
NETGEAR ReadyNAS. NETGEAR’s knowledge base says ReadyNAS storage systems and ReadyNAS software are end-of-life, without giving a date. That covers more than 100 ReadyNAS OS 6 models, and the last OS 6 download offered is 6.10.8. [34]
ASUSTOR. Thirty entries on ASUSTOR’s status page show software support Ended, from the AS10, AS50, AS51, AS70, AS-20, AS-30 and AS-60 series. [35] Seventeen more models, in the AS31xx, AS32xx, AS40xx, AS61xx and AS62xx families, are on security updates only. [35][36] ADM 4.3.3 will be their last security update, and from 1 February 2027 they get none. [36]
TerraMaster. TerraMaster’s support staff announced on its official forum that TOS 4.x reached end of life on 1 May 2026, with no security updates after that, and that the 210 series (F2-210, F4-210) cannot go past TOS 4.x. [37] Updates for the 220 and 420 series (F2-220, F4-220, F5-220, F2-420, F4-420 and F5-420) ended on 31 December 2024. [38]
D-Link. Twenty legacy models, 17 of them DNS-series NAS units such as the DNS-320L, DNS-325, DNS-327L and DNS-340L, are past end of service, with no patch coming. [12]
AI-generated illustration. A few minutes shining a light on the model, software version and support status shows where your NAS stands.
You need an admin login for the NAS, or at least physical access to read its label. Only check equipment you are responsible for. If an IT provider looks after the NAS, ask them to go through this with you.
Four steps to check whether a Synology or QNAP NAS still gets security updates
Step
Synology
QNAP
1. Find the model
Read the label, or sign in and open Control Panel, Info Center, General, which shows the model name and serial number. [39] If you cannot sign in, Synology’s Web Assistant at finds.synology.com, or its Synology Assistant desktop app, finds the NAS on the office network. [40]
The label usually shows the model name. Qfinder Pro shows it as Device Type, and Control Panel shows it once you sign in. [41]
2. Find the version
Control Panel, Info Center, General, or Control Panel, Update & Restore, DSM Update, where it is shown as the current DSM version. Web Assistant shows it too. [42] DSM writes an update as, for example, 7.2.2-72806 Update 9. Synology’s advisories write the same build as 7.2.2-72806-9. [3] If yours starts 7.2-64570, you are on plain DSM 7.2, which has had no DSM update since February 2025. Builds starting 7.2.1-69057 or 7.2.2-72806 are on the 7.2 branches Synology last updated on 12 October 2026. [26]
Control Panel shows the firmware version once you sign in, and so does Qfinder Pro. [41]
3. Look it up
On Synology’s Product Support Status page, set Product Availability to All (the default hides older models), type the model and read the DSM Update column. [5] That page does not show the last DSM a model can run. For that, use Synology’s last upgradable version list, or the model’s page in the Download Center. [4]
On QNAP’s Product Support Status page, find the model and read the Technical Support and Security Updates column, not the availability label. [8] Then check the model’s firmware page in the Download Center. [28]
4. Compare
Find your version in the Synology table above. On DSM 7.4, 7.3, 7.2.2 or 7.2.1, check your build is at least the one SA-26:19 names for your branch: 7.4.1-90080 Update 1, 7.3.2-86009 Update 5, 7.2.2-72806 Update 10 or 7.2.1-69057 Update 13. [67] Then install the latest update anyway. Older versions have no DSM fix listed. On DSM 6.2 or later, if Web Station, WordPress, Synology Calendar, Mail Station or another package that uses PHP is installed, open Package Center and install the PHP and package updates listed in SA-26:14. [23][24] SA-26:14 has no fix for PHP 7.3. If it is installed, move any site that uses it to PHP 7.4 or later, then stop or remove PHP 7.3 (our advice). [24] SA-26:14 lists no fix for DSM older than 6.2, and Synology recommends turning off the affected packages until the NAS is upgraded to a supported DSM version. [24][23]
Find your version in the QNAP table. If it is older than QTS 5.2 or QuTS hero h5.2, it is past QNAP’s published end dates. [7]
Your Synology may not tell you about new versions
Since DSM 7.2 in June 2023, the notes for each new DSM release list a fixed group of 16 to 19 series models that get no notification of that release on the NAS, and must be updated by hand from the Download Center. They include the DS216j, DS216+, DS916+, DS918+, DS718+, DS218+ and DS119j, but not the DS218, DS418 or DS118. From DSM 7.3, the notes give optimal stability as the reason, and say these models “will remain on their most suitable version”. [26] Synology also says an update may not show on a NAS because of staged rollouts, its Smart Update feature, or because the update is not pushed to that system. [43]
In our view, many of these units may still be on DSM 7.1 or 7.2 without the owner knowing a newer version exists. Check the Download Center for your model, not just the NAS’s own update page.
The DSM version check in our free NAS ransomware check compares your build with the fixed builds in SA-24:20 and SA-26:19, as at 11 November 2026. Nothing you type is sent anywhere.
AI-generated illustration. An unsupported NAS has three ways forward: update it if you can, cut it off from the internet, or replace it.
What to do depends on where your NAS sits. Find the row that matches yours, and read the warnings under the table before you change anything.
If this is you, do this
If this is you
Do this
Still supported, but behind on updates
For example, a DS216j still on an older DSM 7.2.2 update, or a TS-251 on an older QTS 5.2 build. Back up, then install the latest update for your version, from the Download Center if the NAS does not offer it. [43] Turn on automatic important updates. DSM’s automatic updates will not move the NAS to a new major version, so check for those yourself. [44] On QTS 5.2, updates are under Control Panel, System, Firmware Update. [45]
Can move to a newer supported version
For example, a DS918+ still on DSM 7.1 or plain 7.2. Upgrade one step at a time: Synology says to check the newest DSM your model supports in the Download Center, then install versions in order, because jumping straight to the latest may corrupt files. [46] Synology does not push new versions to the DS918+ and similar models, for stability, so read the release notes for your model before upgrading by hand. In our view, DSM 7.3 (LTS, extended life to about October 2028) is the smaller step, and 7.3.2-86009 Update 5 or later closes SA-26:13 and SA-26:19. [26][6][3] Work through Synology’s pre-update checklist, [47] and check your packages: DSM 7.4 ends support for PHP 8.1, [48] and Mail Station and Synology Mail Server are not supported on DSM 7.4 or above. [49]
Stuck on a final version that is out of support
For example, a DS414 on DSM 7.1, a DS412+ on DSM 6.2 or a TS-431 on QTS 4.3.6. Plan to replace it. Until then, take it off the internet and do not keep the only copy of anything important on it. ASD’s advice, when upgrading is not an option, is to isolate unsupported products from networks where possible and not to use them to store important data, [16] and QNAP recommends not connecting end-of-life devices to the internet. [11] The ISM asks for compensating security controls in the meantime. [19] Still install any package fixes Synology offers, such as the October 2026 PHP fixes, and on DSM older than 6.2, where there are none, disable Web Station, WordPress and the other affected packages, as Synology recommends. [24][23]
Already showing errors, a degraded pool or a rebuild
Do not update, migrate or start a repair yet. If the data can still be read, copy what matters to a separate device first, or call us before changing anything. Synology’s checklist asks for drives to show Healthy before an update, and says to avoid repairing or expanding volumes while it runs. [47] Synology describes a degraded pool as one where one or more drives have become defective but the pool is still accessible and no data has been lost yet. [50] Keeping it that way is the priority.
Before you change anything
Back up first. Make a current copy on a separate device and check that files open from it. Synology strongly recommends a backup before any DSM update, and QNAP recommends backing up all data before a firmware update. [44][45]
Updates cannot be rolled back. Synology says DSM updates are irreversible, [44] and its DSM 7.4 notes say a NAS cannot be downgraded once 7.4 is installed. [26] QuTS hero blocks firmware downgrades from h6.0.0, [29] and a QTS unit cannot be converted to QuTS hero in place. [51] QNAP shows a risk warning you must accept before it installs an older QTS by hand. [52]
Do not upgrade or migrate a degraded or rebuilding pool. This is our advice from the lab. An upgrade or a migration adds load and change to an array that is already short a drive, and we would rather see the data copied off first. Synology’s pre-update checklist points the same way. [47]
Take it off the internet. Check for port forwarding, UPnP and relay services such as QuickConnect, and close what you do not need. Our guide Is your NAS on the internet? shows how. QNAP and ASD both advise keeping unsupported devices off the internet. [11][16]
Moving to a new NAS
Moving to a new NAS safely.
AI-generated illustration. Like a hermit crab checking a new shell, copy your data across and check the copy before you switch over.
Replacing an unsupported NAS is the cleanest fix. The move itself is where data goes missing, so the order of work matters more than the tool.
The order we recommend
Record the old array while it is healthy. Note the model, the drive order and the storage settings before anything is unplugged. Our free Array Passport records a healthy array’s layout on one page, so there is a record if a drive fails part way through. Synology’s drive migration guide also says to record the bay order and keep it. [49]
Copy first. Back up everything to a separate device before you start. Synology strongly recommends a Hyper Backup copy and a Configuration Backup (Control Panel, Update & Restore, Configuration Backup) before any of its migration methods, [53] and QNAP says to confirm you have a complete, recent backup first. [54]
Verify the copy. Open files from the copy, not the original. In Hyper Backup, Check backup integrity tells you whether the backup can be restored, and Backup Explorer lets you browse it. [55]
Keep the old drives untouched until the new NAS is checked. Do not wipe, reuse or reformat them until you have opened your files on the new unit. That way the old drives stay a fallback.
Migration Assistant runs on the new NAS and copies data, packages and system settings over the network. The old NAS needs DSM 6.0 or later, and the new one DSM 7.0 or later, on the same or a newer version. It does not carry over licences or some network settings, and only certain models are supported as source or destination, so check yours first. [56]
HDD migration moves the old drives into the new model, in the same bay order. If the installer warns that all data on the drives will be deleted, do not continue. Synology’s guide says to power the NAS off with a long press of the power button and check the drives are in their original bay order, and to abort and use Hyper Backup instead if the warning appears. If you are ever prompted to format the drives, stop and contact Synology Support, or call us. [49]
Hyper Backup copies everything across. Synology calls it the safer method, and it needs twice the space of the data. Synology does not recommend moving drives from a newer model to an older or discontinued one. [53]
QNAP’s three ways
Direct System Migration moves the drives with their data and settings, if both models support it. Update the new NAS’s firmware before inserting the disks, and remove any SSD cache from the old NAS first. [54]
Back up and reinitialise carries over volume data only. Settings and apps are not kept. [54]
Hybrid Backup Sync copies from the old NAS to the new one over the network. [54] A QTS unit cannot be converted to QuTS hero in place, so moving to QuTS hero means copying the data across. [51]
Our view: for an out-of-support NAS, copying the data across (Migration Assistant, Hyper Backup or Hybrid Backup Sync) is usually safer than moving the old drives into the new unit. The old drives stay untouched as a fallback, and the new NAS does not start life on ageing disks.
Retiring the old unit
Retiring the old unit properly.
AI-generated illustration. An old NAS has earned its retirement only once the data is copied and checked and its drives are wiped.
Once the data is on the new NAS and checked, the old drives still hold everything they ever stored. A factory reset is not the same as wiping them. The short version: before the old drives leave your hands, securely erase each one (Secure Erase on a Synology, Complete or SSD mode on a QNAP), or have them destroyed. In our view, a reset or reformat is not enough. [57][58]
Reset and erase options on Synology and QNAP, and whether they are enough before disposal
Option
What it does
Enough before disposal?
Synology RESET button (Mode 1 or Mode 2)
Resets the admin login and network settings, or all system settings. Synology says stored data is not affected. [59]
No.
Synology Erase All Data (System Reset)
Erases all user data on the drives and restores default settings. [60] Synology does not say it overwrites the drives.
Not as a wipe, in our view.
QNAP Restore factory default settings and format all volumes, or Reinitialize the NAS
Restores the default settings and formats all volumes, or deletes all data on the disks and reinstalls QTS. [61] QNAP does not describe either as secure erasure.
Not as a wipe, in our view.
Synology Secure Erase
Storage Manager, HDD/SSD, select the drive, Action, Secure Erase. Synology says to run it before discarding or handing on a drive. It is not available while the drive is still active in the storage, is unhealthy or sits in an expansion unit, and SAS drives and some drive models may not support it. It can take hours. The drive has to come out of its storage pool first, so only delete the pool after your data is checked on the new NAS. Secure Erase is also unavailable on a drive holding the only healthy system partition. [57] In our reading, the last drive left in the old unit may therefore have to be erased elsewhere or destroyed.
Yes, by Synology’s description.
QNAP Secure Erase
Storage & Snapshots, Storage, Disks/VJBOD, Disks, select a free disk, Action, Secure Erase. Complete overwrites every block with zeros or ones, and Customized sets the number of rounds and can use a random pattern. SSD sends the ATA secure erase command on supported SSDs. Fast overwrites only the partition and RAID configuration data. [58]
Complete or Customized for hard drives, SSD mode on supported SSDs. Not Fast mode. QNAP does not mention a check afterwards.
The government benchmark, if you need one
ASD’s Information Security Manual sets out how to wipe drives. In short: overwrite a hard drive in full at least once with random data, check it, and also run the drive’s own secure erase command, because overwriting alone misses sectors the drive has set aside as faulty. Overwrite an SSD at least twice with random data and check it, because not every block may be reached. Destroy any drive that cannot be wiped, such as a failed one, and remove labels that link it to its past use. The full list has more steps, so give your IT provider the link. [62] We use the ISM as a benchmark; nothing we read makes it a legal requirement for a private small business.
If the NAS held personal information
If your business is covered by the Privacy Act, APP 11 requires reasonable steps to destroy or de-identify personal information you no longer need. The Office of the Australian Information Commissioner (OAIC) says information is destroyed when it can no longer be retrieved, and that where hardware cannot be sanitised, the information has to be destroyed another way. [63] Most small businesses with an annual turnover of $3 million or less are not covered, but health service providers and some others are covered whatever their turnover. [64] If you are not sure which applies to you, check before the drives leave the building.
Old IT can come up in privacy cases. In the first civil penalty case under the Privacy Act, the weaknesses the Federal Court listed against Australian Clinical Labs included a Windows server Microsoft no longer supported, although neither the court nor the OAIC says that server caused the breach. [65][66]
Before the old unit leaves the building
Your data is on the new NAS, and you have opened files from it.
Every old drive has been wiped, or is labelled and locked away until it can be.
Drives that failed or cannot be wiped are destroyed, not thrown out. [62]
Labels and asset tags that link the drives or the unit to your business are removed. [62]
Free tools
Two free tools for an ageing NAS.
Both run in your browser, and both are on our free tools hub.
NAS ransomware check
Its version check compares your Synology DSM build with the fixed builds in Synology’s SA-24:20 and SA-26:19 advisories, as at 11 November 2026. It also asks plain-language questions about internet exposure, and has a first-hour card to print if a NAS has already been hit.
Array Passport
Records a healthy array’s layout on one page, before anything goes wrong. Fill it in before an upgrade or a migration, so there is a record if a drive fails part way through.
Vendor documentation, advisories and release notes come first, then ASD, the OAIC and the original researchers. Where we draw our own conclusion from a source, the text says so. Every source was read on 6 November 2026, and source 67 on 11 November 2026.
Press release, 29 October 2026. Attackers are exploiting a flaw patched in December 2024 (SA-24:20); update now and turn on automatic updates. Names no DSM versions.
Published 5 November 2024, updated 28 March 2025. The advisory Synology links to C3RB3R. Fixes for DSM 7.2.2, 7.2.1, 7.2, 7.1 and 6.2; the DSM 6.2 fix was added on 5 December 2024.
18 September 2026. Critical, eight CVEs, three usable without a login (two of them Critical). Fixed builds listed for DSM 7.4, 7.3, 7.2.2 and 7.2.1 only.
Published 24 June 2021, updated 6 July 2021. Final firmware update in 2015; units compromised through multiple vulnerabilities; disconnect them from the internet.
14 February 2022. High or critical fixes for some end-of-life models, effectively until October 2022. Do not connect end-of-life devices to the internet.
Published 4 April 2024, updated 3 September 2024. Twenty legacy models past end of service life, 17 of them DNS-series and three DNR-series; no patch; retire and replace.
Press release, 22 October 2026, updated 28 and 29 October 2026. PHP security updates through Package Center for DSM 7.4 and 7.3 and for the end-of-life DSM 7.2, 7.1, 7.0 and 6.2. On DSM earlier than 6.2, turn off the affected packages until the NAS is upgraded to a supported DSM version.
Published 22 October 2026, updated 31 October 2026. Critical. Fixed PHP, Synology Calendar and Mail Station packages for DSM 7.2 or above, DSM 7.0 to 7.1 and DSM 6.2; no fix for PHP 7.3, which is end of life; no rows for DSM earlier than 6.2.
Every DSM branch and update for this model, including DSM 7.4-90075 (16 June 2026), the 12 October 2026 builds and the list of models that get no update notification.
Updated 29 September 2026. Record and keep the drive bay order; what to do if warned that all data on the drives will be deleted; Mail Station and Mail Server are not supported on DSM 7.4 or above.
Updated 22 October 2026. Secure Erase in Storage Manager, when it is unavailable (including a drive still active in the storage or holding the only healthy system partition), and how long it takes.
Four reset options. Restore factory default settings and format all volumes formats every volume; Reinitialize the NAS deletes all data and reinstalls QTS.
10 November 2026. Critical, two CVEs usable without a login (CVE-2026-76954 rated 9.8, CVE-2026-85101 rated 8.6), no mitigation. Fixed builds listed for DSM 7.4, 7.3, 7.2.2 and 7.2.1 only: 7.4.1-90080 Update 1, 7.3.2-86009 Update 5, 7.2.2-72806 Update 10 and 7.2.1-69057 Update 13.
Viktor (Dante) Burcevski
Executive Data Engineer/Owner, Wildfire Data Recovery. IACIS Certified Forensic Computer Examiner (CFCE). Wildfire’s Brisbane laboratory accepts matters from across Australia.
Call us on 1300 806 557. Tell us the make and model, the DSM or QTS version and what you are seeing, and we will explain your options in plain language. If the NAS is showing ransom notes, renamed files or a crashed or degraded pool, leave the drives as they are, and do not start a repair or an upgrade before you call.
