→ Applies to: SynetoOS 4.x

This article explains how to update SynetoOS 4 appliances to protect them against the PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) and the eMudhra certificate authority compromise (CVE-2026-114406).

IMPORTANT
PHP2Shell is a critical vulnerability that allows unauthenticated remote code execution through the web interface. Treat this update as an emergency security update, especially if the management interface is reachable from untrusted networks. Restricting network access to the management interface reduces the risk temporarily, but does not replace this update.

NOTE
This update is an immediate hardening measure. It is strongly recommended to plan an upgrade to SynetoOS 6, which includes these security fixes and receives the latest reliability and security improvements.

PREREQUISITES
- Administrative access to the SynetoOS web interface
- Root access to the SynetoOS CLI
- A maintenance window
- Recent, verified recovery points for the protected workloads
- Outbound connectivity to the SynetoOS update repositories

Step 1. Update SynetoOS to version 4.8.6 ("How to Update SynetoOS 4")

NOTE
Skip this step if the appliance is already running SynetoOS 4.8.6.

Step 2. Connect to SynetoOS appliance via SSH as admin

ssh admin@<your_ip_address_or_hostname>

Step 3. Change into Solaris shell (in case you're directed to an unsupported shell)

un sh

Step 4. Get root privileges

sudo su -

Step 5. Check the current SynetoOS version

config firm show

EXAMPLE OUTPUT

Syneto Storage 4.8.6.4777
Hardware ID: 448d6b4b36fe7013303194d5a836154d
Serial Number: SYNETO-S/N
Luna Version: 1.1.0-87

NOTE
The version must be 4.8.6. If it is lower, complete Step 1 first.

Step 6. Check whether the appliance still trusts the compromised eMudhra certificates

curl https://dv-g3b-emudhra.we-have-a-problem.com/

curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

EXAMPLE OUTPUT

Your client successfully connected to the site. That's bad!
Your client successfully connected to the site. That's bad!

NOTE
Before the update, this result is expected: it confirms that the appliance still trusts the compromised certificates. The same check is repeated in Step 11 after the update.

Step 7. Check the security package update (dry run, no changes are applied)

pkg image-update -nv

EXAMPLE OUTPUT

            Packages to update:         5
            Services to change:        11
     Estimated space available:  54.51 GB
Estimated space to be consumed: 323.61 MB
       Create boot environment:        No
Create backup boot environment:       Yes
          Rebuild boot archive:        No

Changed packages:
syneto.eu
  library/python-3/certifi-39
    2019.11.28-151038.0:20210926T215102Z -> 2019.11.28-151038.0:20261023T190616Z
  library/python-3/pip-39
    21.0.1-151038.0:20210917T064615Z -> 21.0.1-151038.0:20261023T192053Z
  management/syneto-os-backend
    4.8.6.4777-151038.0 -> 4.8.8.5706-151038.0
  runtime/php
    7.3.22-151038.0 -> 7.4.33-151038.0
  web/ca-bundle
    5.11-151038.0:20210923T150340Z -> 5.11-151038.0:20261023T190846Z

Services:
  restart_fmri:
    svc:/application/cake-persistent-cache-cleaner:default
    svc:/application/database/memcached:default
    svc:/application/diskinfo-cache-regenerator:default
    svc:/application/remove-wsdl-cache:default
    svc:/application/schedule-default-cronjobs:default
    svc:/application/setup-guest-account:default
    svc:/application/show-welcome-message:default
    svc:/application/syneto-service-vm:default
    svc:/network/php-fpm:default
    svc:/system/djworker:default
    svc:/system/update-man-index:default

NOTE
Check that the output lists the runtime/php, web/ca-bundle and management/syneto-os-backend packages and shows no errors.

Step 8. Apply the security package update

pkg image-update

NOTE
Wait for the command to finish without errors. The affected services are restarted automatically and a backup boot environment is created.

Step 9. Refresh the displayed SynetoOS version

rm /tmp/VERSION

NOTE
The update in Step 8 already installs version 4.8.8. On appliances that were already running 4.8.6, the displayed version is cached and still shows 4.8.6 until the appliance is restarted. Removing the cached version file makes the installed version 4.8.8 appear immediately.

Step 10. Verify the updated SynetoOS version

config firm show

EXAMPLE OUTPUT

Syneto Storage 4.8.8.5706
Hardware ID: 448d6b4b36fe7013303194d5a836154d
Serial Number: SYNETO-S/N
Luna Version: 1.1.0-87

NOTE
The version must now be 4.8.8.

Step 11. Verify that the compromised eMudhra certificates are no longer trusted

curl https://dv-g3b-emudhra.we-have-a-problem.com/

curl https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

EXAMPLE OUTPUT

curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

NOTE
The connection must fail with “SSL certificate problem”. If the output still says “Your client successfully connected to the site. That’s bad!”, the update was not applied correctly. Contact Syneto Support.

IMPORTANT
To minimize future risks, avoid exposure of the SynetoOS management interface directly to the Internet, and keep the appliance on supported maintenance releases.