# IT Daily Roundup: October 17, 2026

> Oct 17, 2026 · #security #backup #remote-access #magento

Attackers delivered a backdoor through tampered AOMEI Backupper update servers, BeyondTrust patched CVE-2026-102764 exploited by a China-linked group since August, and Magento faces a critical RCE flaw in email templates.

## 1. AOMEI Backupper delivered a backdoor through tampered update servers

Researchers from Google Threat Intelligence Group and ManageEngine Threat Analysis Lab found that a threat actor tracked as UNC7017 changed update files directly on AOMEI's servers three separate times. Each window lasted only a few minutes: May 28, July 16, and July 20, 2026. Machines that checked for updates during those windows downloaded and executed the malicious package. AOMEI Backupper does not verify update file integrity cryptographically, so changing two text files on the server was enough.

The delivered package contained the CROSSROAD downloader, a signed copy of Radmin, a DLL loading the SHINYROAD implant (a remote shell capable of loading new code), and on some machines the Adaptix C2 framework disguised as Nitro PDF software. A scheduled Windows task ensured the implant ran every three hours. During the third window, the attackers modified the notification file to trigger a hidden WebDAV request that leaked NetNTLMv2 authentication hashes without running any program. Victims were identified in IT services, telecommunications, and higher education across 11 countries. AOMEI told Mandiant in late July that it had corrected its servers. That did not clean infected machines.

> **Why this matters:** Backup software runs with elevated privileges and typically carries an exclusion in endpoint protection. Check all machines running AOMEI Backupper for scheduled tasks named RadminComponentRuntime or NitroRuntime, and review network logs for the April to July period. Version 8.5.0, which is current, still does not verify update files cryptographically.

## 2. China-linked Armory Castle has exploited a BeyondTrust Remote Support flaw since August

BeyondTrust patched an authentication bypass, CVE-2026-102764, in Remote Support versions 26.2.3 and earlier on October 8. An unauthenticated attacker can perform arbitrary file operations on a vulnerable appliance. Mandiant and Google GTIG link exploitation of this zero-day to Armory Castle (CrowdStrike: Warp Panda), a suspected China-nexus espionage group. After gaining initial access, the attackers escalated to root by enabling SUID permissions, deployed the Sawfly web shell and Bareclaw tunneler, and wiped logs to cover their tracks. Shadowserver tracks more than 1,400 internet-exposed BeyondTrust Remote Support instances.

SaaS customers received the patch automatically on October 8. Self-hosted installations without automatic updates enabled must be patched manually. Any instance that was internet-reachable on a vulnerable version since late August should be treated as potentially compromised until a log and access review is complete.

> **Why this matters:** IT outsourcing teams use BeyondTrust Remote Support specifically because it gives them access inside a customer's network. A compromised server hands an attacker the same reach. The patch is available now.

## 3. Critical Magento flaw: BlockStrap allows PHP code execution through email templates

Sansec reported CVE-2026-103849 in Adobe Commerce and Magento Open Source, which received a maximum severity rating. The flaw sits in the email template engine: content from a child template is signed and processed again at the root level without the appropriate restrictions, allowing an attacker who can edit an email template to execute arbitrary PHP code on the server. Affected versions include Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3.

Adobe rated it priority 2, recommending a patch within 30 days. Sansec considers that too lenient: the previous similar flaw, StyleSmuggler, went from a priority 1 hotfix to mass exploitation in three days. A patch is available as an isolated hotfix or in the October 2026 release. A plain `composer update` is not enough; the hotfix for VULN-39341 (StyleSmuggler) must remain in place alongside the new fix.

> **Why this matters:** Email templates in Magento are regularly edited by less technical administrators, which broadens the attack surface. If you run a Magento store or manage one for a client, install the patch today rather than waiting for the next scheduled update cycle.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-10-17-it-daily-roundup.html