Synology DSM C3RB3R Ransomware + 3 More

If you run a Synology NAS on an outdated DSM version, update DSM today and check that the management interface is not exposed to the internet. On October 29, Synology warned of ransomware attacks (C3RB3R) against outdated DSM. If you self-host GitLab, update and also confirm your Ruby carries the fix (CVE-2026-97229, CVSS 10.0). For Linux kernel CVE-2026-98432 (CVSS 9.8), neither Ubuntu nor Red Hat had a fixed kernel as of November 3. We also cover the TeamViewer 15.83 update. CISA has added nothing new to its Known Exploited Vulnerabilities (KEV) catalog since October 30. Of the four items below, two have confirmed exploitation.

This digest is based on official pages from Synology, GitLab, Alpine Linux, Ubuntu, Red Hat and TeamViewer, and CISA KEV data (October 30 release), checked on November 3 (JST). Synology has not published the CVE number used in the attacks, so we write "not disclosed." Press reports (BleepingComputer) are marked separately from what we confirmed in primary sources. Anything not stated is shown as "not stated."

In a notice dated October 29, Synology warned that attackers are exploiting a vulnerability patched in December 2024 to encrypt data on NAS devices running outdated DSM and demand a ransom. It urges users to update DSM immediately and enable automatic updates. The notice does not name the flaw, but links to the November 2024 security advisory SA-24:20.

- Severity: SA-24:20 lists three CVEs: CVE-2024-10441 (remote code execution, CVSS v3.1 9.8 Critical), CVE-2024-50629 (limited file read, 5.3 Moderate) and CVE-2024-10445 (limited file write, 4.3 Moderate). Synology has not said which one is used in the attacks
- Affected: DSM older than the fixed versions in the advisory (the 7.2.2, 7.2.1, 7.2, 7.1 and 6.2 lines). BeeStation OS before 1.1-65374 is also affected
- Fixed: DSM 7.2.2-72806-1, 7.2.1-69057-6, 7.2-64570-4, 7.1.1-42962-7 (or later in each case), and DSM 6.2.4-25556-8 or later
- Exploitation: the notice states attacks are happening. The three SA-24:20 CVEs are not in CISA KEV. Press reports say encrypted files get a .L0CK3D extension and a ransom note named read-me3.txt (BleepingComputer, citing Synology)

How to check: in DSM, open Control Panel, then Update & Restore, and apply any pending update. If your NAS is exposed through router port forwarding, close external access to the management ports (such as 5000/5001). For NAS costs see file server and NAS costs for SMBs; for ransomware response see ransomware basics for SMBs.

We covered CVE-2026-109618 / 109619 as PHP flaws on October 26 (see the PHP response guide). Synology now lists fixed versions of its own packages in SA-26:14 (PHP2Shell), published October 22. On October 31 it added Calendar and Mail Station for DSM 6.2, 7.0 and 7.1.

- Fixed: Calendar 3.0.4-21435 or later (DSM 7.2+), Mail Station 30000002.3.19-20333 or later (DSM 7.2+), PHP 8.2 8.2.35-0171 or later, PHP 8.4 8.4.27-0051 or later, and so on. PHP 7.3 has no fix (end of life)
- Exploitation: not stated in SA-26:14. The PHP flaws themselves are in CISA KEV (added Oct 26)

How to check: open Package Center in DSM and look for updates to Calendar, Mail Station and PHP packages. Remove PHP packages you do not use.

An integer overflow in the regular expression compiler used for CI/CD configuration lets an unauthenticated attacker potentially run code on the GitLab server with a crafted regex. The fix shipped on October 12 and CISA added it to KEV on October 29 (also covered in our October 30 digest). What is new is the account Alpine Linux published of attacks on its own GitLab.

- Severity: CVSS v3.1 10.0 (Critical), assigned by GitLab. Vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Affected: 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 (GitLab advisory)
- Fixed: 19.4.2, 19.3.5 and 19.2.8. GitLab.com is already patched and GitLab Dedicated customers need no action
- Alpine's timeline: it mistakenly moved to 19.3.4 on October 13. On October 20-21 an attacker sent crafted CI configurations that crashed workers eight times. On October 22 Alpine moved to 19.3.6, but the fix lives in Ruby (the Onigmo regex engine), not in GitLab code, so its custom setup remained vulnerable. Alpine found no confirmed compromise but could not rule it out because of missing logs, and rebuilt the instance
- Exploitation: in CISA KEV. Press reports say Shadowserver counted over 1,000 unpatched internet-exposed instances on Sunday, November 1 (BleepingComputer)

How to check: see the GitLab version on the Help page in the admin UI. If you built the environment yourself rather than using official packages or containers, also check the Ruby version. If the server was exposed while unpatched, consider rotating passwords and reviewing logs.

This follows up the IPv4 TCP use-after-free (remotely reachable without authentication, CVSS 9.8) from our November 1 digest. See the November 1 digest for how it works. We checked both vendors' official pages on November 3 and no fixed kernel had been released.

- Ubuntu: priority High, CVSS 9.8, page updated November 3. Kernels for 24.04 LTS, 22.04 LTS and 26.04 LTS are listed as vulnerable with work in progress. The standard kernels for 20.04 LTS and earlier are listed as vulnerable. Many cloud kernels (AWS, Azure, GCP and others) are vulnerable or in progress
- Red Hat: bulletin RHSB-2026-016 is marked ongoing and was updated on November 2. It says only that fixes are being expedited and does not state whether the flaw is exploited
- Interim measure: Red Hat publishes an nftables rule that drops IPv4 TCP packets with IP options. It reduces exposure but is not a full fix and may disrupt workloads, so test before production. For OpenShift, node-level rules do not filter pod-to-pod traffic and guidance is still being evaluated
- Exploitation: not in CISA KEV (October 30 release)

TeamViewer published security bulletin TV-2026-1011 on October 27 (updated October 28) covering three vulnerabilities. This is older than 24 hours, but we had not covered it and many small businesses use the tool. TeamViewer says it was not aware of active exploitation at publication.

- CVE-2026-92372 (CVSS 8.8, High): out-of-bounds write in the screen-image decoder of the Linux and macOS client. Crafted screen data, or a malicious .tvs session recording, could lead to code execution. User interaction required. Versions before 15.83
- CVE-2026-111585 (CVSS 8.8, High): integer overflow in screen processing, affecting the Full Client, Portable and the Android Remote Control app. Connecting to a malicious host could cause denial of service or, depending on the platform, possible code execution. Versions before 15.83
- Fixed: 15.83 (legacy branches: see the bulletin)
- Exploitation: TeamViewer says it is not aware of any. Not in KEV. No workaround other than updating is listed

How to check: open TeamViewer and choose Help, then About TeamViewer, to see the version. If it is older than 15.83, update. Do not connect to unknown hosts or open .tvs files of unknown origin.

- Ask your IT contact or vendor whether the company has a NAS (especially Synology). If so, check the DSM version and update it today if it is old
- Check that the NAS management interface is not exposed to the internet through router settings. If it is, close it
- Check that NAS backups also exist somewhere other than the NAS itself (an external disk or the cloud)
- If you run GitLab yourself, confirm the version is 19.4.2, 19.3.5, 19.2.8 or later. If you built containers yourself, ask your vendor to confirm Ruby is updated too
- If you use Linux servers, decide who will update and when, so you can patch on the day Ubuntu or Red Hat releases the fixed kernel
- Tell everyone who uses TeamViewer to update to 15.83 or later
- Record the date and the person responsible for each action

Related: November 1 digest (Linux CVE-2026-98432), October 30 digest (GitLab CVE-2026-97229), Ivanti Connect Secure exploitation and response. For the cost of a vulnerability assessment, see vulnerability assessment cost.

- Synology: DSM update notice (C3RB3R)
- Synology-SA-24:20
- Synology-SA-26:14 (PHP2Shell)
- BleepingComputer: Synology warns customers of ongoing C3RB3R ransomware attacks
- GitLab: 19.4.2, 19.3.5, 19.2.8 patch release
- Alpine Linux: GitLab security incident
- BleepingComputer: Over 1,000 GitLab servers vulnerable
- Ubuntu: CVE-2026-98432
- Red Hat: RHSB-2026-016
- TeamViewer: TV-2026-1011
- CISA KEV
- Debian Security Tracker (CVE-2026-98432; fixed in bookworm via DLA-4841-1 and trixie via DSA-6568-1): https://security-tracker.debian.org/tracker/CVE-2026-98432