QNAP QTS 6.1 public beta: first look at the list of no-longer-supported items

These past few days, the articles about QNAP QTS 6.1 have mostly focused their headlines on "new interface," "passwordless login," and "AI on NAS." I laid out those official pages and read through them, and let me give the conclusion first: this version is more usable for ordinary home users, but for people who have run self-hosted services on NAS, it is a real subtraction.

Because this version contains a list titled "Starting from 6.1.0, QTS no longer supports the following applications." It is not in the promotional materials; it is in the release notes.

First, align the dates and version numbers

There are three official documents with different dates, which are easy to confuse:

• Release notes page: QTS 6.1.0.3640 build 20261007 Public Beta, the date marked on the page is 2026-10-13(qnap.com.cn release notes).
• Official press release: the title is QNAP Releases QTS 6.1 Beta, the place of issue is Taipei, date 2026-10-16。
• Official community: a public beta announcement post was published on the same day, and the post wrote the build number in full;On October 23, another version 6.1.0.3656 build 20261023 Public Beta was pushed。

That is to say, what can be downloaded now is actually two different public beta packages. This point is critical in the security section later; keep it in mind.

What this official version adds

The items listed in the press release are not complicated; I have ordered them by relevance to home readers:

• Redesigned interface + guided initialization: the login page, desktop, taskbar, and dialogs have all been redesigned, and initialization has been changed to step-by-step guidance.
• Customizable dashboard: system health, CPU and memory, storage capacity, and temperature are placed on one screen; cards can be added, removed, and resized; the layout is synchronized across devices using a QNAP account.
• QNAP account login + FIDO2 Passkey: after a local NAS account is linked to a QNAP account, you can log in directly; Passkey supports physical keys such as YubiKey, and also supports Touch ID and Windows Hello.
• Snapshot Replica resumable transfer: if a snapshot backup is interrupted midway, it resumes from the breakpoint instead of redoing the whole set.
• Kernel upgraded to Linux 6.6(The official original wording is more stable, stronger protection, and compatible with more new hardware).
• The AI part: Added AI Service Center, which can run locally or in the cloud; Qsirch supports finding files by natural language description; QuAgent can check system status, handle files, and give storage planning suggestions through conversation. It also supports installing an Intel Arc Pro B70 GPU in the machine and viewing the model, temperature, and utilization directly in the control panel.

The Passkey item has a prerequisite, and the official release notes state it very clearly:It must be accessed via HTTPS with a domain name, and FIDO2 Server must already be installed. If there is no domain name and you log in via pure IP, this feature cannot be enabled—this is not because the setting is hidden deep, but because the conditions are insufficient.

What really needs to be looked at is that "no longer supported" list

The exact wording in the official release notes is "Starting from 6.1.0, QTS no longer supports the following applications." The list is very long; I'll pick the several groups that really affect tinkerers.

Python and Python3 are gone

This item is placed first because it has the broadest impact. The Python environment bundled with QTS has always been a prerequisite for many scripts—scheduled tasks, batch file organization, API automation, and a bunch of third-party packages that depend on it behind the scenes. The official listing of it as "no longer supported" means that after upgrading, the runtime environment for these scripts must be rebuilt by yourself.

Can it be bypassed? Yes, but you have to do it yourself: either run it in a container or install an independent runtime environment yourself. The difference is—previously it "was already in the system," and later "you have to maintain a copy yourself."

PHP extensions, phpMyAdmin, and MariaDB 5/10 go offline together

Putting these three together points to the same thing:The path of building a site directly on QNAP with Web Server + database comes to an end in 6.1.

Running a personal blog, image host, or small photo album site on a NAS used to be a typical use of this combination. Now PHP extensions and phpMyAdmin are no longer supported, and the two major versions MariaDB 5 and 10 are also on the list. If you really have a site running on it, think clearly before upgrading about where it will live next week.

PPPoE is also on the list

This item is unnoticeable to most people and painful to a few: the trick of using the NAS directly as a dial-up device (the machine dials by itself to get a public IP address) is gone. Few people did this before, but there really was a group who configured it this way just to save a router.

Surveillance and several remote tools

QVR Elite is on the list, officially marked as replaced by QVR Surveillance—this is a rename and generational replacement, so it's still acceptable. What really needs attention are QuWAN vRouter, VJBOD Cloud, TeamViewer, Q'center, Qmiix Agent, QUSBCam2, Notifications: some are removed directly, and some are given no replacement. If you use Q'center to centrally manage multiple machines, be sure to confirm a replacement plan before upgrading.

The list also includes niche but used applications such as JRE, Mattermost, MinimServer, IFTTT Agent, and CloudBackoGo. All entries are subject to the official release notes; I have only picked a few groups above.

By the way, one awkward-looking spot in the list: Qsirch is in the application tools section, but the same version of the official release also talks about Qsirch's natural language search. My understanding is that the old standalone app goes offline and the feature is merged into the system, but there is no explicit official wording confirming this,For this point, I suggest you confirm with the official source yourself, and don't use this sentence of mine as a basis.

There are also two easily overlooked details

First, the public beta only supports some applications.The official text says: "QTS 6.1.0 Public Beta currently only supports some applications"; the complete list is the link in App Center filtered by version, and more will be supported only in the official release. That is, if you install it now, some third-party packages cannot be installed or will not run, and this has nothing to do with whether there is a problem with your machine.

The second is the new certificate rules.The release notes say that this version requires the certificate's validity period field to conform to the ITU-T X.690 encoding specification and to include complete seconds. Certificates signed by mainstream tools and public CAs generally comply, but those signed by an enterprise internal CA or built into a device may not—those that do not comply will fail to load directly.Certificates already imported can still be used before the service restarts or the machine restarts, but after that they may not work. Those who have set up their own internal CA need to check this in advance.

Another item affects only a few people: starting from QTS 6, new file-level LUNs can no longer be created; existing ones can continue to be used and can be exported, and when re-imported they will become block-level LUNs.

This security item is much more important than the new UI.

On October 22, the security media outlet AppleInsider reported two high-risk PHP vulnerabilities, code-named PHP2Shell, with IDs CVE-2026-109618 and CVE-2026-109619, which can lead to unauthenticated remote code execution. The report mentioned that QNAP issued a security advisory that day, and the affected scope includes QTS 5.2.11 and earlier versions, as well as QTS 6.1.0and said that QNAP had not yet provided a remediation timeline at that time, recommending that users first turn off unnecessary port forwarding, UPnP, and remote access services.

But the second public beta package mentioned earlier is different:In the release notes for 6.1.0.3656 on October 23, the security updates section explicitly states that updates for the two PHP2Shell IDs have been incorporated.。

Putting these two things together leads to a very specific conclusion:If you just want to try the new UI, do not stop at the 3640 package; use 3656 directly.The same phrase "public beta" does not mean the same package or the same security status. For vulnerability details and fix scope, refer to the original QNAP official security advisory; here I only relay the wording of public reports and release notes.

My judgment: three types of people, three answers.

Machines that store important data and are used for production—do not upgrade now.The reason is not nonsense like "public betas have bugs," but three specific ones: the public beta only supports some applications, so your packages may not install; the PHP and Python environments have been cut, so services that depend on them will break; if something really goes wrong and you need to roll back, rolling back across major versions is itself risky, and data is exposed during the rollback.

Tinkering machines, spare machines, and those who want to try it out—you can upgrade, but follow the order.First confirm that the model is in the supported model list (Qu405, Qu605, Qu805, TS-464C, TS-264C and this batch are all included; older models not in the list cannot be installed), then back up data to another device or an external drive, and then install the 3656 package, not 3640. After installation, the first thing is not to look at the UI, but to go to App Center and check whether your commonly used packages are still there.

For those who have built sites on a NAS and run self-hosted services—do not expect that "a simple upgrade will make everything fine."The PHP and MariaDB stack is broken in 6.1. The short-term solution is to move the site into a container (PHP and Python in the container are not affected by system package changes), and the long-term solution is to move it to a proper server.NAS is suitable for storing things, not for being a website host long-term—this list only makes clear a conclusion that has always existed. If you plan to move to the cloud, how to choose the configuration and how bandwidth and renewal fees are calculated, I have organized it onthe cloud server purchasing pagein there.

Do three things before upgrading

First, list the commonly used packages, then check each one in the official App Center filtered by the 6.1.0 Public Beta version to see whether it is still there. This step is more accurate than reading any review.

Second, back up. Not the “I have RAID” kind of backup, but a readable copy of the data on another device or on drives that have been pulled out. RAID cannot stop mistaken operations, nor can it stop a broken system installation.

Third, turn off external access first. Port forwarding, UPnP, and remote access services do not need to be on during the upgrade; turn them on as needed after the upgrade, and before turning them on, change what should be changed. I wrote this sequence inthe IPv6 remote access articlein the order “ONT—firewall—DDNS”; the approach is general. For those used to vendor relay,the QuickConnect articleexplains clearly why it is sometimes slow.

One more thing: if you have one of those recently purchased 4-bay models, I discussed the hardware trade-offs inthis 2599 machinearticle; before upgrading, it is worth comparing to see which part of its capabilities you are actually using.

Basis of this article: QNAP official release notes “QTS 6.1.0.3640 build 20261007 Public Beta” (qnap.com.cn, page date 2026-10-13) and the QNAP official community announcement “QTS 6.1.0.3656 build 20261023 Public Beta” (including the “no longer supported applications” list and security update items); QNAP official press release “QNAP Releases QTS 6.1 Beta” (2026-10-16, Taipei); security media AppleInsider’s 2026-10-22 report (PHP2Shell, CVE-2026-109618 and CVE-2026-109619, relaying QNAP’s 10-22 security advisory). Features, support scope, affected models, and fix status are subject to QNAP official pages and the original announcements; “NAS is not suitable as a long-term website host” and “rolling back across major versions is risky” are personal judgments and have not been tested in this article.

All articles index · Back to homepage