QuikStation Security Patch 2026-10 (v13)
========================================

WHAT THIS IS

  A security patch for the web management interface (Apache / PHP) of the
  RDX QuikStation 4, QuikStation 8 and QuikStation8_10G. It has two layers.

  1. Mitigation (qs-secfix.sh)
     Configuration changes only (Apache / PHP / TLS). Works on every
     firmware (1.x, 2.x, 3.x). Contains the PHP-project mitigations for
     php2shell (CVE-2026-109618, CVE-2026-109619) and web-server / TLS / PHP
     hardening settings.
  2. PHP fix (qs-phpfix.sh)
     PHP 7.4.33 plus the PHP security team's official fix for
     CVE-2026-109618/109619, built with the firmware 3.3.0.5 toolchain:
     the Apache PHP module (libphp7.so) and the php command. The root fix
     for php2shell, plus every fix up to the final 7.4 release (7.4 itself
     is end-of-life). Firmware 3.3.0.5 only.

  NOTE: the root fix for these vulnerabilities can only be applied to the
  latest firmware, 3.3.0.5, so this patch includes the update to firmware
  3.3.0.5 and performs it itself. (The patch runs on every firmware version.)

  One command does everything - qs-patch.sh (or QS-SecurityFix.bat on
  Windows). What it does depends on the firmware:

    1.x (1.3.6 - 1.5.1.26)   mitigation applied, then ONE REBOOT to confirm the
                             changes are stored (see PERSIST below);
                             RESULT: MITIGATED and the
                             message: only the mitigation is available on
                             this firmware - to get the fixed PHP, update to
                             2.5.2 or later (procedure at the link shown) and
                             run this patch again
    2.5.2 - 3.2.x            mitigation applied, then the firmware is updated
                             to 3.3.0.5 with the included quikstation_3.3.0.5.swu
                             (THE UNIT REBOOTS - a few minutes, up to about 10
                             on some models). After it is back: PHP fix, then
                             3.3.0.5 into the other boot area as well (a second
                             reboot), then the PHP fix in both boot areas. The
                             Windows / macOS / Linux launchers wait for each
                             reboot and continue by themselves; when run on
                             the unit directly, run the patch again after each
                             reboot
    3.3.0.5                  PHP fix and mitigation (if not yet) applied. If
                             the other boot area holds a firmware older than
                             3.3.0.5, 3.3.0.5 is installed there too (THE UNIT
                             REBOOTS once), then the PHP fix goes into both
                             boot areas. If both boot areas already run 3.3.0.5
                             the unit REBOOTS once after applying, to confirm
                             the changes are stored (PERSIST: VERIFIED)

  The unit reboots only for these firmware updates; backups and iSCSI
  connections are interrupted during each reboot, so make sure no backup is
  running. Otherwise backups, iSCSI connections and the network link are not
  affected. The web console stops for a few seconds while the patch is
  applied - do not use the web console while the patch runs.

FIRMWARE UPDATES AND THE PATCH

  Firmware 3.3.0.5 is included, and the firmware update needed for the PHP
  fix is performed by the patch itself (on 2.5.2 - 3.2.x, and on 3.3.0.5
  when the other boot area is older; the unit reboots, so run the patch
  when no backup is active).
  - Currently on 1.5.1.26 or earlier (1.x): the patch cannot update 1.x to
    2.x (three-step procedure, link below). Apply the patch first so the
    unit is protected by the mitigation, update to 2.5.2 or later, then run
    the patch again (it then performs the update to 3.3.0.5 and the PHP fix).
    https://drive.google.com/file/d/1C4yG0U92Van-UYk4u5ptwxw-rBgTesYe/view?usp=drive_link
  - After any future firmware update or downgrade, run the patch once more
    (a 2.x/3.x update keeps the mitigation, but the PHP fix is gone from the
    rewritten boot area). From v10 the patch keeps a stored copy of the fixed
    PHP on the unit (/etc/qs-secfix/php, about 6 MB) and re-installs the fix
    at boot by itself when the rewritten boot area holds the stock PHP of a
    supported firmware (2.8.0.8 - 3.3.0.5); re-run the patch anyway to be
    certain.
  Firmware 3.3.0.5 on its own: https://overlandtandberg.co.jp/downloads

WHAT YOU NEED

  - SSH enabled on the QuikStation (web console: System Settings > Options
    > Diagnostics > Allow Remote Access (SSH)) and the key file downloaded
    from that same tab. Each unit has its own key.
  - The unit's address (the one you use for the web console).

WINDOWS (one click)

  1. Save the key file into THIS folder, next to QS-SecurityFix.bat.
  2. Double-click QS-SecurityFix.bat.
  3. Enter the unit's address, then type YES when asked.
  4. The run ends with "RESULT: PROTECTED" (on firmware 1.x with
     "RESULT: MITIGATED" and a note on how to get the PHP fix). Firmware
     updates and their reboots are handled by the tool; it may take 10-25
     minutes in total on a unit that needs them.

  Check only:   QS-SecurityFix.bat <address> /STATUS
  Undo:         QS-SecurityFix.bat <address> /RESTORE
  Nothing is installed on the PC; plink.exe / pscp.exe (PuTTY) are used
  from this folder and the Windows registry is not touched. Windows 7+.
  About 26 MB are copied to the unit (plus 96 MB when a firmware update is needed).

macOS / LINUX

  ./qs-patch-apply.sh <address> <key-file>             apply
  ./qs-patch-apply.sh <address> <key-file> --status    check only
  ./qs-patch-apply.sh <address> <key-file> --restore   undo

  Or manually:
    ssh -i <key-file> vtx@<address> "mkdir -p /tmp/qsfix"
    scp -O -i <key-file> qs-patch.sh qs-secfix.sh qs-phpfix.sh libphp7.so php vtx@<address>:/tmp/qsfix/
    (-O: needed with a recent OpenSSH, the unit has no SFTP)
    (only when --status shows a PLAN: FWUPDATE... line)
    scp -O -i <key-file> quikstation_3.3.0.5.swu vtx@<address>:/srv/www/tmp/
    ssh -t -i <key-file> vtx@<address> "sh /tmp/qsfix/qs-patch.sh"

AT THE UNIT (console or USB stick)

  Copy the six files above (qs-patch.sh qs-secfix.sh qs-phpfix.sh
  libphp7.so php quikstation_3.3.0.5.swu) to a FAT32 USB stick, log in on the console as
  vtx, mount the stick (mount -t vfat /dev/disk/by-label/<LABEL> /mnt/usb)
  and run
    sh /mnt/usb/qs-patch.sh
  Do not open the .sh files in Notepad - it breaks them.

AFTER APPLYING

  - "sh qs-patch.sh --status" must report RESULT: PROTECTED (RESULT:
    MITIGATED on firmware 1.x).
  - On a unit running the fixed PHP the firmware version shown by the web
    console (About, system page) ends with "_phpsec" (for example
    03.003.00.5_phpsec). It is shown only while the fixed PHP is running and
    disappears by itself when the fix is gone (firmware update, --restore).
  - Connecting to the web console now requires TLS 1.2 or later.
  - If the mitigation prevented the web server from starting, it rolls
    itself back automatically and says so.
  - Run this patch once more after any firmware update.
  - On the QuikStation 8 the system runs from a copy in RAM made at boot; the
    patch updates the boot areas on disk AND the running copy. If the RAM copy
    cannot be updated it reports RESULT: INSTALLED - RESTART THE UNIT: restart
    the unit from the web console, then run the patch again.
  - RESULT: FIRMWARE UPDATE IN PROGRESS: a firmware update was accepted and the
    unit has not rebooted yet. Nothing is changed. Wait for the reboot (up to
    about 15 minutes) and run the patch again - do not re-run before that.
  - PERSIST: VERIFIED means a marker written by the patch before a reboot is
    still there, i.e. the storage keeps what is written. Some units suffer from
    storage that silently drops writes; only a reboot reveals that, which is
    why the patch reboots 1.x units and both-slots-3.3.0.5 units once.
  - RESULT: STORAGE FAULT means the unit's internal storage has become
    read-only (rare). The patch then skips the firmware update (no reboot);
    mitigation and PHP fix stay active until the next reboot only. Send the
    tool's log file and the web console's log download to support.
  - Disable SSH on the unit again in the web console when finished, and
    delete the downloaded key file (it gives administrative login).

FILES

  QS-SecurityFix.bat    Windows launcher (one click)
  qs-patch.sh           the patch, run on the unit (calls the two below)
  quikstation_3.3.0.5.swu  firmware 3.3.0.5 (installed by the patch where needed)
  qs-secfix.sh          mitigation settings
  qs-phpfix.sh          installer of the PHP fix (firmware 3.3.0.5 only)
  libphp7.so, php       fixed PHP 7.4.33 (built for 3.3.0.5)
  qs-patch-apply.sh     macOS / Linux launcher
  plink.exe, pscp.exe   SSH programs (PuTTY project), used by the .bat
  qs-keyconv.ps1        converts the unit's key file for plink
  PUTTY-LICENCE.txt     licence of the two PuTTY programs
  README.txt / README-ja.txt    this file
  SHA256SUMS            checksums, to confirm the files are intact
