Synology’s latest 2-bay DS225+ NAS is a solid way to get started with network attached storage systems. It offers a streamlined and simple experience with an affordable-enough price for those who have never used a NAS before.

Synology DS225+ Network Attached Storage server.

7/10

Brand

Synology

CPU

Intel Celeron J4125

Memory

2GB

Drive Bays

2

The Synology DS225+ is a great beginner storage server. It features two 3.5-inch hard drive bays and both 2.5Gb Ethernet and Gigabit Ethernet. Designed around Synology’s Disk Station Manager operating system, this NAS offers a simplified experience that anyone will feel at home using. 


Pros & Cons

  • Easy to use
  • Good read/write speeds even without cache
  • Synology’s established ecosystem of apps
  • Solid build quality
  • 7 year old processor
  • Only 2GB of RAM stock, and only expands to 6GB max
  • No NVMe or M.2 support


Person testing the performance of a laptop


How We Test and Review Products at How-To Geek

We go hands-on with every product to ensure it’s worth your time and money.

Price and availability

The Synology DS225+ 2-bay NAS is available to purchase from Amazon, Best Buy, and B&H for $340.

Brand

Synology

CPU

Intel Celeron J4125

Memory

2GB

Drive Bays

2

Expansion

None

Ports

2x USB 3.2 Gen 1

Caching

None

OS

Disk Station Manager

Price

$340

Dimensions

165 mm × 108 mm × 232.2 mm

Weight

1.3 kg (2.86lbs)

Storage

40TB

Wi-Fi

None

LAN Ports

1x Gigabit Ethernet, 1x 2.5Gb Ethernet


Synology continues making great starter NAS systems

If you’ve never used a NAS before, the DS225+ is one of the best places to start

Close-up of the Synology DS225 Plus logo on the front of the 2-bay NAS. Credit: Patrick Campanale / How-To Geek

I’ve used a lot of NAS systems over the years. From building my own to using pre-made ones, there’s a lot to like about many of the brands. Synology focuses on one thing, and they get it right: simplicity.

A Synology NAS is extremely simple to set up, and the DS225+ is no exception. From pulling it out of the box to having it ready to use was just a few minutes. Of course, clearing the drives and building the RAID array took a while, but that’s not a limitation of the system, but just a function of RAID itself.

Disk Station Manager also remains the simplest NAS operating system to use. Synology has perfected it over the years, and it really shows. If I had a family member looking for an entry-level NAS, I would have zero hesitation in recommending that they get the DS225+.

Older hardware doesn’t mean that there’s no power here

Though I would have liked to see more than 2GB of RAM

Rear side view of the Synology DS225 Plus 2-bay NAS with fan and ports visible. Credit: Patrick Campanale / How-To Geek

Synology is known for being pretty stingy in the CPU and RAM department, and the DS225+ is no exception to that, either.

It ships with a 2019-era Intel Celeron J4125 processor. This 4-core 4-thread CPU is fine for lightweight NAS tasks, but it wouldn’t be my ideal choice for something like a Plex server. The J4125 does have Intel’s UHD Graphics 600, which means it can handle transcoding, but it might struggle with newer codecs.

The RAM department on this NAS is also a bit of a letdown. For starters, it only ships with 2GB of RAM. However, the biggest drawback is it maxes out at 6GB of RAM. If you compare the DS225+ to other NAS systems in the price range, about $50 more gets you a Ugreen NAS with a much newer Intel N100 processor and 8GB of RAM, though there’s no way to upgrade it.

Really, there is no reason that Synology should be using a 2019-era processor and 2GB of RAM for a NAS in 2026. There are so many better options to choose than a J4125. I really do wish Synology would have done better in this area.

However much I wish Synology would have used more powerful hardware in this NAS, I will say that it runs fairly well. The apps I did run on it, like Synology Drive and moving files around, all worked just fine. I just don’t really know how long the NAS will last performance-wise with these measly specs.

No NVMe drive is a bit of a letdown

I’d like to see some caching abilities

Synology HAT3300-4T 4TB hard drive held in front of the DS225 Plus NAS. Credit: Patrick Campanale / How-To Geek

I’m a huge fan of NVMe caching in a NAS, but the DS225+ doesn’t allow that at all. The only drive bays on this NAS are the two 3.5-inch bays on the front. There’s no SSD support anywhere, which is a bit of a letdown.

While that does stink, I was able to see fairly decent transfer rates to the NAS thankfully. On a gigabit connection, I saw full network saturation both for moving files to and from the DS225+. My test file was a 4GB video export from one of my YouTube videos to simulate an actual workload of what I would be moving around on the NAS.

Really, it doesn’t need a NVMe drive, but I have more reasons than just caching for wanting NVMe storage. The aforementioned Ugreen NAS which offers more power and RAM for $50 more than the DS225+ also has two M.2 NVMe slots inside.

Having NVMe on a NAS means that you can run local services off of faster storage instead of spinning disks. Things like Plex metadata, Synology Photos, or any other container or app you might run just work better when the data is on a SSD instead of a hard drive.

It feels like not including NVMe support is just one more corner that Synology cut in the DS225+. It’s not a necessity, but, when other brands are including those features without charging a ton more, it’s something they easily could have done and chose not to.

The Synology ecosystem is still unmatched

It’s hard to argue with just how simple Synology makes its ecosystem to use

Now, the real reason people buy a Synology isn’t for the horsepower or hardware specs, it’s for the ecosystem and experience. In those areas, Synology is still unmatched and the DS225+ really shows its expertise.

While I’m a big fan of NAS platforms from other companies, nobody does an ecosystem better than Synology. There is still no rival to Synology Drive on any modern NAS. If you want a NAS that is a true Google Drive replacement, it’s hard to argue with the value Synology delivers.

I’ve messed with NextCloud in the past, as well as a few other Google Drive replacements, and they all require far too much upkeep and break too often for me to actually rely on. Synology Drive is reliable, works on all platforms, and uses my own hardware as a cloud storage replacement—which is the main reason most people buy a NAS in the first place.

Synology Photos is another stand-out feature here. It acts as a full Google Photos or iCloud Photos replacement and it just works well. Sure, Immich does exist, but Synology Photos is simpler to set up, easier to use, and requires a lot less maintenance.

Should you buy the Synology DS225+ NAS?

Rear side view of the Synology DS225 Plus 2-bay NAS with fan and ports visible. Credit: Patrick Campanale / How-To Geek

The Synology ecosystem does a lot of heavy lifting for the Synology DS225+. If any other NAS manufacturer had released a system with the specs and hardware features of the DS225+ in 2026, it likely wouldn’t succeed at all. But, the DS225+ has Synology’s ecosystem, brand recognition, and operating system to lean on, and that’s why this NAS will be a success.

However, if you want to buy a NAS that does it all, the Synology DS225+ is a great choice. It might not be the fastest system, and it might not have the most hardware features, but the software experience is what seals the deal here, and Synology knows it.

The actual experience of using this NAS is great for beginners and I’d definitely recommend it if you want a plug-and-play solution for your home network. At $340, this is about the best bang-for-your-buck 2-bay NAS you can get without encroaching on the $400 mark.

Though, if you can spend a few more bucks, and you don’t mind setting up a few more services yourself, there are definitely better NAS options out there.

Synology DS225+ Network Attached Storage server.

7/10

Brand

Synology

CPU

Intel Celeron J4125

Memory

2GB

Drive Bays

2

The Synology DS225+ is a great beginner storage server. It features two 3.5-inch hard drive bays and both 2.5Gb Ethernet and Gigabit Ethernet. Designed around Synology’s Disk Station Manager operating system, this NAS offers a simplified experience that anyone will feel at home using. 




Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)







Source link