The vulnerability in the news
Two warnings landed in the last week of October, and they make a good pair.
Synology told owners of its network storage boxes, the NAS in the closet that holds the shared drive and too often the backups, that attackers are encrypting devices running old software. The holes being used were patched anywhere from weeks to nearly two years ago, depending on whose report you read, and the boxes that got hit simply hadn’t been updated. The same week, CISA added a VMware ESXi flaw to its list of vulnerabilities being used in real attacks. Its severity score is 2.7 out of 10 because an attacker already needs admin access to use it, but what it buys them is the ability to work without leaving a log.
There are two wrong answers to news like this. One is the kneejerk: buy a tool, sign a monitoring contract, unplug the NAS and break payroll on a Friday. The other is the shrug, because we’re small and the IT company handles it.
The right answer takes about an hour. Check whether you actually own the thing, from a list rather than from memory. Check whether the internet can reach its admin page. Look at CISA’s free Known Exploited Vulnerabilities list, because anything on it jumps the line no matter what the score says. And ask what breaks if it goes, because backups sitting on the box that just got encrypted aren’t backups.
Most weeks the fix after that hour is an update and a setting or two, plus a note of who did it and when. That’s a risk assessment, and it doesn’t need a new product. It needs someone whose job is to ask those questions the morning the news breaks.
When Synology’s warning came out on 29 October, who at your company would have known whether you own one?
Sources: NAS Compares on the Synology attacks (30 Oct 2026), GBHackers on CISA adding CVE-2026-41709 (29 Oct 2026), CISA Known Exploited Vulnerabilities catalog.