decrypted · 21 october 2026 · vulnerabilities and patching · supply chain · ai and llm security

AOMEI's update servers were rewritten for minutes at a time, and no vulnerability was involved

AOMEI Backupper, a popular Windows backup tool, spent months handing out malware through its own update mechanism, and no software vulnerability was needed. Google's Mandiant team and ManageEngine's threat researchers published the details last week, and The Record reported on Tuesday that AOMEI had not yet identified or notified the affected customers.

How the trick worked

Think of a post room that obeys any note pinned to its noticeboard. Backupper reads two settings files from AOMEI's servers. One says where to download an update and what its fingerprint should be. The other says what message to show and what to run. Neither file is signed, and the fingerprint sits inside the very file it is meant to protect. An attacker who briefly rewrites the noticeboard can name their own parcel and its fingerprint, and the software accepts both. ManageEngine's researchers said nothing in Backupper was exploited, so there is no CVE to patch.

The edits were brief. Mandiant confirmed tampering for ten minutes on 28 May, six on 16 July and five on 20 July, after which the files were restored. Any copy that checked in during those minutes received a legitimate remote administration tool, Radmin, plus a backdoor that ran in memory. On 20 July the attackers added a trick needing no malware at all: a banner that made the computer contact an attacker's server and leak its login hashes.

What defenders can see

Mandiant says malware samples appeared in the wild from late April, so the three confirmed windows are a floor, not a ceiling. Both teams urge hunting across April to July. Useful clues include scheduled tasks named RadminComponentRuntime or NitroRuntime, and unsigned executables inside AOMEI's temporary html folders. Google advises blocking outbound file-sharing and WebDAV traffic to external addresses, which also defuses the hash-leak trick.

The sources I read name no UK victim, but backup software sits on UK laptops and servers all the same. Fixing AOMEI's servers does not clean machines already infected.

The Secure by Design lesson

The design error is trusting an instruction for where it came from rather than who signed it. Updates should be signed with a key kept off the web servers, and the client should refuse anything that fails the check. Then a hijacked server can only serve what the vendor already approved. That costs a vendor little against months of silent access.

Buyers can ask for it: does the product verify signed updates, and what is the supplier's promise on notifying you? AOMEI says it has found no malicious files since, yet it could not initially find the root cause, and ManageEngine says it has not independently verified that the attackers lost access. For UK directors the practical step is an inventory. Which small utilities phone home across your estate, with what privileges, and who would tell you if their server were quietly rewritten?

Also this week

PHP, patches due today. The PHP project said on Tuesday it will release security updates today at 3pm UK time for two vulnerabilities it rates 9.2 on the CVSS v4.0 scale. It has not published affected versions. Security firm watchTowr says both allow remote code execution, affect PHP 5 onwards and are worth CVSS 10, and it has seen no exploitation. The CVE numbers, CVE-2026-109618 and CVE-2026-109619, come from watchTowr and a since-deleted forum post, not from PHP's notice, so treat them as reported. PHP also reserved the right to release early. Know where PHP runs in your organisation, including inside content management systems, and be ready to patch this afternoon.

Rogue AI agents get a checklist. US agencies including NIST and CISA published voluntary guidance on incident readiness for frontier AI developers, with ten practices across prepare, detect, respond, recover and report. They include least privilege, credential management, and isolating systems and revoking credentials when an agent misbehaves. SecurityWeek's verdict was that it offers no new ideas on agent governance but is a clear checklist. UK organisations deploying agents can borrow it, because a checklist written in advance beats improvisation at 2am.

A court asks WhatsApp for more proof. A US judge declined to hold spyware maker NSO Group in contempt of an injunction over alleged new attacks on WhatsApp users. She found WhatsApp lacked clear and convincing evidence, after it limited what it disclosed to protect its detection methods. Access Now warned that demanding such detail risks impunity for the spyware industry. The awkward bind for victims, including UK journalists and campaigners, is that proving an attack can mean revealing how you spot it.

Sources