A Synology owner on Reddit had a NAS encrypted by ransomware, Tom’s Hardware reports. The NAS had its web interface open to the internet and sat roughly 18 months behind on security patches. The owner kept 3-2-1 backups and seemingly lost nothing. Late patching was one mistake. Exposing its admin page to the internet was the other.

The owner’s investigation points to CVE-2024-10441, a remote code execution bug in DSM’s system plugin daemon that Synology rates 9.8 out of 10 and that needs no account and no click from the owner. Synology had shipped the fix long before. This attack only needed a box facing the internet that had missed the update. I do not know why the owner missed it, but it does tell a similar tale to many older PCs that had lapsed security patches.

Still, Synology’s slow responses are, at this point, somewhat known, and what made me question its reliability was Docker. Container Manager, DSM’s Docker package, moved to Docker Engine 24.0.2 in February 2025, eight months after the 24.0 branch had reached end of life. The branch’s final patch, 24.0.9, never shipped on DSM. Container Manager’s latest release, from August, still runs 24.0.2, while Docker itself is on version 29. An engine already past end of life was part of why I moved my containers off the NAS and onto a Linux box. Now, I have even moved data out of my Synology NAS to a DIY box.

When I still had a Synology NAS, my rule of thumb was that it never faced the internet directly. I either put Synology’s own QuickConnect in the middle or connected through a VPN into my LAN.

That rule of thumb still holds for most owners. QuickConnect beats port forwarding. It doesn’t need you to forward a port, or trust router firmware from how many years ago, and Synology brokers the connection. For those who need more customization, Tailscale reaches the NAS without opening a port on the router. Some adages hold true: keep your device up to date, check if your device can receive the latest update, and unless needed, keep devices off the internet.