PHP fixed two unauthenticated code-execution flaws on October 21. Synology released fixes the next day, but QNAP, whose OS ...