Critical PHP2Shell flaws patched in PHP; PAN-OS still unfixed
CVE-2026-109618 and CVE-2026-109619 are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Palo Alto has no PAN-OS fix yet.
76
- Mentions · 7d5
- Mentions · 30d5
- All mentions5
- First seenOct 19, 2026
- Last mentioned10h ago
Timeline
5 articles · newest firstAOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI has not notified customers after update-server malware hijack
Attackers briefly swapped update configs from April to July so Backupper fetched malware, and already infected PCs stay infected.
74
UNC7017 hijacks AOMEI updates for minutes to plant backdoors
Tampered update configs in brief windows between April and July 2026 could leave CROSSROAD and SHINYROAD after the servers were fixed.
76
AOMEI update servers briefly served CROSSROAD and SHINYROAD malware
UNC7017 altered promotion configs for minutes in May and July so Backupper ran malware without user action.
74
Related CVEs
by mentions- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-10961812%9.2OOM longjmp memory flaw enabling RCE in PHP
Appears with
- AOMEI Backupperproduct · 5
- UNC7017threat actor · 4
- Google Threat Intelligence Grouporganization · 4
- ManageEngineorganization · 4
- CROSSROADmalware · 3
- SHINYROADmalware · 3
- Radminproduct · 3
- Mandiantorganization · 3
- Sublime Securityorganization · 1
- ADAPTAGENTmalware · 1
- Searchlight Cyberorganization · 1
- AOMEI AnyViewerproduct · 1
- Wizorganization · 1
- Microsoft 365product · 1
- Microsoftvendor · 1
- PHPproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.