Synology NAS (DSM): updates and ransomware protection

Updated November 2026

A Synology NAS is safest when DSM installs important updates on its own, its admin page is not reachable from the internet, every admin signs in with two factors, and your files are covered by immutable snapshots plus an off-site Hyper Backup copy. Check first that your model still gets updates: as of November 2026, models from the x15 generation and older no longer do.

Which DSM versions are supported

Synology publishes a Software Life Cycle Policy (last updated October 13, 2026) with dates for each DSM minor version. In the Maintenance Phase Synology releases critical security fixes and urgent bug fixes. Versions marked LTS (long-term support) get an extra Extended Life Phase with critical security fixes only. Synology calls the future dates approximate and says they may be extended.

DSM life cycle as of November 2026 (Synology Software Life Cycle Policy)
Version	Released	End of Maintenance Phase	End of Extended Life	Status now
DSM 7.4	June 2026	June 2028	–	Supported (current)
DSM 7.3 (LTS)	October 2025	October 2027	October 2028	Supported
DSM 7.2	June 2023	December 2025	–	No more updates
DSM 7.1 (LTS)	April 2022	June 2024	June 2025 (older models only)	No more updates
DSM 6.2 (LTS)	May 2018	June 2021	September 2024	No more updates

On October 12, 2026 Synology released DSM 7.4.1-90080 Update 1 and DSM 7.3.2-86009 Update 5, both described as “Fixed security vulnerabilities”. If your NAS shows an older build, update now. To see your version, open Control Panel > Info Center > General.

Does your model still get updates?

Look up your model on Synology’s Product Support Status page. Its OS/Firmware Update column says Full (all updates), Limited (security updates only) or End of Life (no further software or security updates). As of November 2026:

End of Life: the x15 generation and older, for example DS415+, DS215+, DS215j, DS115j, DS1515+, plus DS216se. Their last version was DSM 7.1, and its extended life ended in June 2025.
DSM 7.4 is the last version for many 2016–2019 models, including DS216j, DS218j, DS218, DS218+, DS418, DS918+, DS1019+ and DS1819+. Some of them (for example DS216j, DS218j, DS218+ and DS918+) are not offered DSM 7.4 automatically and stay on DSM 7.3, which is LTS; you can install 7.4 by hand from the Download Center.
Newer models such as DS220+, DS223j, DS224+ and DS923+ get full updates.

End-of-life NAS. An unsupported NAS will not be patched, even for a critical flaw. Take it off any port forwarding and QuickConnect, keep it only on a trusted LAN segment, and plan a replacement. See running end-of-life systems.

Turn on automatic updates

DSM has two kinds of update. Major updates (such as 7.3 to 7.4) add features and you start them yourself. Minor updates fix security issues and bugs, and Synology marks a minor update as important when it fixes a critical security issue.

Go to Control Panel > Update & Restore > DSM Update and click Update Settings.
Choose Automatically install important updates (security fixes only) or Automatically install the latest updates (all updates for your current DSM version; this never moves you to a new major version).
On models released in 2024 or earlier, set the days and time when DSM checks and installs, for example Tuesday and Friday at 03:00. Models released in 2025 or later check daily and install at the scheduled time.

An update restarts the NAS and cannot be rolled back, so take a backup first. On 2025 and newer models, the notification for an important update includes a link to postpone it, for up to 28 days in total.

Updates roll out by region over a few days, and DSM may hold back an update it decides your configuration does not need. If an advisory says you are affected and nothing is offered, download the file from the Synology Download Center and use Manual DSM Update.

Packages (Synology Photos, Drive, MailPlus, Web Station and others) update separately: in Package Center > Settings, turn on automatic updates. Several 2026 advisories (MailPlus Server, Chat Server) were for packages, not DSM.

Watch Synology security advisories

Synology lists advisories as Synology-SA-YY:NN at synology.com/security/advisory, with severity, status (Ongoing or Resolved) and affected products. Subscribe to the RSS feed at https://www.synology.com/api/rssfeed/security/en-global. For example, SA-26:13 (DSM, Critical) was marked resolved on September 18, 2026. Ongoing means a fix is not yet out for every product.

Stop exposing DSM to the internet

In July 2019 Synology reported a ransomware wave in which attackers guessed admin passwords by brute force and encrypted data. No vulnerability was involved: the sign-in page was simply reachable from the internet.

Do not forward ports 5000 (HTTP) and 5001 (HTTPS) on your router. Check Control Panel > External Access > Router Configuration and remove any rules DSM created through UPnP. Also check the router itself.
For remote admin, use a VPN (on your router or the VPN Server package) and reach DSM by its LAN address.
QuickConnect (Control Panel > External Access > QuickConnect) lets apps reach the NAS without port forwarding, through Synology’s relay if needed. It still publishes the DSM sign-in page under your QuickConnect ID. If you do not need it, turn it off. If you do, open Advanced > Advanced Settings and enable it only for the apps people use.
Turn on the firewall in Control Panel > Security > Firewall and allow management ports only from your LAN or VPN subnet.
Enable Auto Block in Control Panel > Security > Protection so addresses with repeated failed logins are blocked.
Create a new administrator account and keep the built-in admin account disabled. Disable SSH and Telnet unless you are using them.

In Control Panel > Security > Account, select Enforce 2-factor authentication for Administrator group users at minimum, or for all users. Users without 2FA must set it up at their next sign-in. Two catches:

2FA also applies to SSH, SFTP and rsync over SSH. Hyper Backup and Shared Folder Sync using rsync with SSH encryption do not support 2FA, so give those jobs a dedicated account.
Adaptive MFA is on by default for admins who have not enabled 2FA. It asks for a second factor only for risky sign-ins (a new device, from outside the network). It does not replace real 2FA.

Run Security Advisor

Security Advisor checks DSM against a set of rules in five groups: Malware, System, Account, Network and Update. On the first scan you pick a security baseline (home or business), which you can change later on the Advanced page. Schedule regular scans:

At Risk or Warning: Weak settings such as weak passwords or open services. Apply the recommended fixes.
Danger: Malware was found. Disconnect the NAS from the internet and follow the ransomware response steps.
Out-of-date: DSM needs updating.

Snapshots and immutable snapshots

Snapshots (in the Snapshot Replication package) record the state of a shared folder so you can roll back after files are encrypted or deleted. They work on shared folders in Btrfs volumes; ext4 volumes cannot snapshot shared folders. A shared folder can hold up to 1,024 snapshots, and each one stores only changed blocks.

Ransomware with admin access deletes snapshots first. Immutable snapshots (DSM 7.2 and later, on supported models) cannot be changed or deleted during a protection period, even by an admin. Synology recommends 7 to 14 days. Volumes and storage pools that contain immutable snapshots cannot be deleted either.

Open Snapshot Replication > Snapshots, select the shared folder and click Settings.
On the Schedule tab, enable a snapshot schedule (for example every hour, keeping 14 days).
Select Enable immutable snapshots and set the protection period, for example 14 days.

Once you make a snapshot immutable, you cannot undo it until the period ends. Allow for the extra disk space.

Snapshots protect against encrypted or deleted files; an off-site backup protects against losing the whole NAS.

Off-site backup with Hyper Backup

Snapshots live on the same disks as your data, so a failed pool, fire, theft or a wiped NAS takes them too. Hyper Backup keeps versioned copies elsewhere: another Synology NAS, an rsync server, Synology C2 Storage, S3-compatible storage and other cloud services, or a USB disk.

Back up to a destination the NAS admin account cannot delete: a second NAS with its own admin accounts and immutable snapshots, or object storage with object lock.
Turn on client-side encryption and store the encryption key outside the NAS.
Use version rotation so that old versions survive if encrypted files get backed up.
Test a restore every few months. See backup planning.

If the NAS is already encrypted

Disconnect it from the network, but leave it powered on. Do not update DSM or delete anything yet. Check whether immutable snapshots or off-site versions from before the attack still exist, then follow what to do after a ransomware attack. Before restoring, change every password and close the exposure that let the attacker in.