Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor

thehackernews.com Oct 16, 2026

Attackers Tampered with AOMEI Backupper’s Update Servers for Minutes to Deliver a Backdoor

Curated by Shubham · TechCapsules · Oct 16, 2026

AI-summarised brief · reviewed before publication

Attackers hijacked AOMEI Backupper’s update servers between May and July 2026, altering two text files for five‑to‑ten‑minute windows. Any Backupper instance that checked for updates during those windows downloaded a malicious backdoor, which ran with the AOMEI process’s privileges and installed a remote‑control payload. The compromise affected organizations in 11 countries, including IT services, telecommunications, and higher education. AOMEI has patched its servers, but infected machines remain compromised. The attack exploited the software’s lack of cryptographic verification.

💡 Why It Matters

· The incident shows how even minor server-side changes can weaponize widely used backup tools, turning routine update checks into a covert delivery channel for ransomware‑style implants.
· It underscores the need for vendors to enforce signed, integrity‑checked update mechanisms.

Capsules Cybersecurity

Read full article on thehackernews.com

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

A local privilege‑escalation exploit released today gains root on OpenBSD 7.9 by chaining a 37‑year‑old integer overflow in the shmat(4) attach function with a newer reference‑count use‑after‑free bug. The overflow, fixed in errata 018 on September 14, allows an attacker to wrap the 16‑bit shm_nattch counter by creating 127 shared‑memory segments and forking 259 processes, producing a negative count. A race condition then triggers the use‑after‑free, leading to an out‑of‑bounds write that corrupts multicast‑membership counters and, when a socket closes, alters page‑table entries to bypass SMAP and SMEP. The exploit overwrites a predictable kernel function pointer, executing arbitrary code despite OpenBSD’s KARL randomization. Both flaws were patched in September via syspatch; no CVEs have been assigned and no known attacks have used them.

💡 The chain proves that deterministic kernel allocators can undermine even strong address‑randomization schemes, exposing a fundamental hardening gap in OpenBSD’s security model.

thehackernews.com · Oct 16

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed…

Drupal’s core Field UI module contains a critical flaw (CVE‑2026‑108097) that allows unauthenticated remote code execution through certain contributed modules. The vulnerability, rated 19/25 by Drupal, was fixed in releases 11.4.10, 11.3.19, and 10.6.19 on October 14. At least one exploit path requires no login, and 28.5% of sites reporting their core version were affected. Sites unable to update immediately can uninstall the Field UI module for temporary protection. The advisory warns that exploits may emerge quickly.

💡 The flaw exposes a high‑risk entry point that bypasses authentication, enabling attackers to run arbitrary code on vulnerable Drupal installations. Prompt patching is essential to prevent potential data breaches and system compromise.

thehackernews.com · Oct 16

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

A China‑linked espionage group known as Armory Castle (formerly UNC5221/Warp Panda) exploited a newly disclosed zero‑day in BeyondTrust Remote Support (CVE‑2026‑102764, CVSS 9.3) on August 29, 2026. The flaw, an improper origin validation in an internal messaging component, allowed remote file operations on self‑hosted appliances. After a second public exploitation on September 27, 2026, BeyondTrust issued patches for SaaS customers on October 9 and urged self‑hosted users of versions 24.3.1‑26.2.3 to apply the BT26‑05‑RS update, while older versions must upgrade. Mandiant detailed that the attackers deployed a lightweight PHP web shell (SAWFLY) to gain encrypted C2, elevate privileges, steal stored credentials, and move laterally. The group has a track record of zero‑day attacks on Citrix and Ivanti devices, targeting high‑value sectors for long‑term intelligence gathering.

💡 The breach shows how state‑aligned actors can weaponize unpatched remote‑support tools to infiltrate critical infrastructure, forcing organizations to reassess exposure of legacy appliances on the internet.

thehackernews.com · Oct 15

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted…

Citizen Lab confirmed that Israeli spyware vendor Candiru infected Al Jazeera devices via zero‑click online ads served by Discover‑Tech. The ads, which loaded silently, sent device identifiers to a Discover‑Tech server that, if the device matched a target, returned malicious code to the browser or app. At least 45 Al Jazeera devices were compromised in 2024‑25, with evidence linking the attack to Candiru. Google, IAB Europe, and other ad platforms removed Discover‑Tech after the findings.

💡 The case shows that state‑backed spyware can reach high‑profile targets through ordinary ad networks, bypassing traditional security checks. It exposes a loophole that lets malicious actors embed malware in seemingly benign advertising, raising urgent questions about ad‑tech vetting and the protection of journalists.

thehackernews.com · Oct 15

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete…

Singapore-based Ahsay Backup released security updates for AhsayCBS after two vulnerabilities, CVE‑2026‑105133 and CVE‑2026‑105134, were exploited to drop web shells and XMRig miners. The flaws allowed attackers to bypass authentication and execute arbitrary commands. Initial patches in August 2026 were incomplete; the company now offers hotfixes in versions 9.15.2.59 and 10.3.4.45. Huntress confirmed the new fix blocks the attack chain, and CISA added the flaws to its Known Exploited Vulnerabilities list, mandating federal patching by October 17, 2026.

💡 The vulnerabilities enabled attackers to gain unauthenticated remote code execution, compromising sensitive data and enabling cryptocurrency mining. Prompt patching is essential to protect federal systems and prevent further exploitation.

techcrunch.com · Oct 15

Citizen Lab says governments are abusing online ads to hack people with…

Citizen Lab researchers revealed that Israeli advertising firm Discover‑Tech is being used by government‑backed spyware developers to deliver zero‑click malware through online ads. The study documents that spyware makers Candiru and Bindecy exploited Discover‑Tech’s platform to target devices worldwide, including at least 45 Windows computers at Al Jazeera. The attacks, occurring in 2024‑25, leveraged malicious ad code that infected devices without user interaction. The report provides the first technical evidence of state‑backed spyware being distributed via ad networks, exposing a broad range of potential targets.

💡 The discovery exposes a new vector for covert surveillance, turning ubiquitous advertising into a weapon that can silently compromise high‑profile devices. This escalation forces a reevaluation of ad‑network security and the effectiveness of current defensive measures.