Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
Product
AOMEI Backupper
- Mentions · 7d0
- Mentions · 30d12
- All mentions13
- First seenSep 10, 2026
- Last mentioned7d ago
Timeline
13 articles · newest firstAOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI has not notified customers after update-server malware hijack
Attackers briefly swapped update configs from April to July so Backupper fetched malware, and already infected PCs stay infected.
74
AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
UNC7017 hijacks AOMEI updates for minutes to plant backdoors
Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.
76
UNC7017 hijacked AOMEI updates to install CROSSROAD and SHINYROAD
Five- to ten-minute tampering windows in May and July 2026 exposed organizations in eleven countries without a CVE.
76
AOMEI update servers briefly served CROSSROAD and SHINYROAD malware
UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.
74
AOMEI Backupper update servers hijacked to deliver a backdoor
Google’s threat intel group confirmed three tampering windows of ten, six, and five minutes between April and July.
74
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
Hallucinated domain in official OpenAI skill underscores AI supply chain risks
An official OpenAI skill pointed apps at an unregistered domain that collected real production tokens.
66
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks
AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.
62
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-12780<1%7.1A vulnerability was determined in AOMEI Backupper up to 8.3.0
Appears with
- Google Threat Intelligence Grouporganization · 10
- UNC7017threat actor · 8
- CrossRoadmalware · 8
- ManageEngineorganization · 8
- ShinyRoadmalware · 8
- Mandiantorganization · 7
- AnyViewerproduct · 5
- Radminproduct · 5
- AOMEI Technologyvendor · 5
- AOMEIvendor · 5
- Adaptix C2malware · 3
- Microsoft 365product · 2
- AdaptAgentmalware · 2
- Microsoftvendor · 2
- ConnectWisevendor · 2
- ConnectWise Cloud Backupproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.