--- title: "PHP2Shell Flaws Patched, Japan Cyberattack Emergency, Backup Software Backdoor | DMARC Report" description: "Explore major cybersecurity news from October 20–26, 2026, including PHP2Shell flaws, Japan’s cyber emergency, backdoors, breaches, and malware." image: "https://dmarcreport.com/og/blog/php2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor.png" canonical: "https://dmarcreport.com/blog/php2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor/" --- Quick Answer Recent cybersecurity threats include PHP2Shell vulnerabilities, cyberattacks in Japan, compromised backup software, data breaches, and supply-chain attacks. Learn about affected systems, critical security patches, and steps to strengthen cybersecurity and protect sensitive data. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=PHP2Shell%20Flaws%20Patched%2C%20%20Japan%20Cyberattack%20Emergency%2C%20Backup%20Software%20Backdoor&url=undefined%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F&title=PHP2Shell%20Flaws%20Patched%2C%20%20Japan%20Cyberattack%20Emergency%2C%20Backup%20Software%20Backdoor "Share on Reddit") [ ](mailto:?subject=PHP2Shell%20Flaws%20Patched%2C%20%20Japan%20Cyberattack%20Emergency%2C%20Backup%20Software%20Backdoor&body=Check out this article: undefined%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F "Share via Email") ![PHP2Shell Flaws and Cybersecurity Threats](https://media.mailhop.org/dmarcreport/dmarc-lookup-9285-1793101720701.jpg) Last week was one of the busiest of the year for **security teams**. A critical PHP flaw put millions of websites at risk, a wave of attacks pushed Japan’s government into emergency mode, and several supply-chain compromises hit software that people trust by default. ## Critical PHP flaws (PHP2Shell) patched in emergency release! PHP published emergency fixes on 21 October for two critical flaws, **CVE-2026-109618** and CVE-2026-109619, which together are nicknamed [PHP2Shell](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html). _Both let an unauthenticated attacker run code on a web server with a crafted request, and proof-of-concept code began circulating after details leaked a day early. Users are urged to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 right away._ [Read the BleepingComputer report](https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws) ## Japan declares an emergency response to a wave of cyberattacks! Prime Minister Sanae Takaichi ordered her cabinet to draw up emergency countermeasures on 26 October, after a run of attacks that have rocked Japan in recent weeks. Earlier, the ruling party had proposed a dedicated headquarters to counter [cyberattacks](https://www.nippon.com/en/news/yjj2026102300867/), and the government said it would step up measures across ministries after a series of personal data breaches. [Read Bloomberg’s coverage](https://www.bloomberg.com/news/articles/2026-10-26/japan-s-takaichi-to-hold-cybersecurity-meeting-as-attacks-grow) and [the government’s response on 23 October](https://www.nippon.com/en/news/yjj2026102300867/) ## Popular backup software used to push a backdoor! Google disclosed a campaign against [AOMEI Backupper](https://www.malwarebytes.com/blog/news/2026/10/aomei-backupper-update-servers-hijacked-to-push-malware-check-your-pc), a Windows backup tool that AOMEI says is used by more than **186 million people**. _Between April and July, attackers briefly swapped AOMEI’s update files for malicious ones, in windows of just five to ten minutes, and any machine that checked for updates during those windows received a backdoor._ No software vulnerability was needed, and AOMEI’s server fix does not clean machines that were already infected. [Read BleepingComputer’s report](https://www.bleepingcomputer.com/news/security/hackers-hijack-aomei-update-servers-to-secretly-spread-malware/) ![Dmarc Check 5630](https://media.mailhop.org/dmarcreport/dmarc-check-5630-1793101842045.jpg) ## Quest Diagnostics confirms patient records were exposed! [Quest Diagnostics](https://cybernews.com/news/quest-diagnostics-patient-data-breach/) learned on 21 October that someone had accessed its Quanum Lab Services Manager, a platform clients use to place test orders and look up results. The company believes certain patient records were accessed, but it has not yet said how many people are affected or what data was taken. It disclosed the incident to the SEC, and the **AP reported** that Quest confirmed the breach is not related to the PHP issue. [Read BleepingComputer’s report](https://bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records) ## Siemens confirms exploitation in ClickFix attacks! Siemens disclosed on 19 October that attackers are exploiting CVE-2026-110936, a DLL sideloading flaw in its **Software Center app**. _Criminals packaged a genuine, signed copy of the app with malicious DLLs, then tricked users into running the payload through ClickFix lures. Siemens fixed the flaw in version 4.0.9.8._ [Read the Infosecurity report](https://www.infosecurity-magazine.com/news/siemens-clickfix-exploiting-side/) ## WordPress backup plugin maker breached, sites backdoored! Attackers breached the website of TeamUpdraft, the developer of the [UpdraftPlus backup plugin](https://cybersecuritynews.com/wordpress-plugin-developer-hacked/), around 17 to 18 October. _They stole connection keys for UpdraftCentral and related services, then used them to install backdoor plugins and create administrator accounts on connected WordPress sites._ Around **400,000 sites** may have been exposed, and updating the plugin alone does not remove a backdoor that is already installed. [Read BleepingComputer’s report](https://bleepingcomputer.com/news/security/stolen-updraftcentral-keys-used-to-backdoor-wordpress-sites) ## Popular AI proxy library poisoned with credential-stealing malware! LiteLLM, an open-source Python library used to route requests to AI model providers, had its release [pipeline compromised on 21 October.](https://www.csoonline.com/article/4239033/litellm-release-pipeline-hacked-to-distribute-credential-stealing-malware.html) A malicious version, 1.107.0, was published to PyPI and Docker for a short time, and it contained malware that steals credentials. Anyone who installed it should downgrade to 1.106.2 and rotate any **API keys**, cloud credentials and developer tokens on the affected machine. [Read BleepingComputer’s report](https://bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware) ![Dmarc Record 8443](https://media.mailhop.org/dmarcreport/dmarc-record-8443-1793101874732.jpg) ## Node.js ships security fixes for ten CVEs! The Node.js project released **security updates** on 21 October for its 22, 24 and 26 release lines. The most serious issue is a [high-severity Brotli decoder flaw (CVE-2026-111497)](https://cybersecuritynews.com/node-js-releases-security-updates/) that can lead to remote code execution. Three other high-severity flaws allow TLS hostname checks to be bypassed. Users should upgrade to 26.12.1, 24.22.1 or 22.23.4\. [Read the Node.js security release notes](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases?assessment=20261021) ## Private keys for eight certificate authority intermediates were compromised! **Researchers reported** on 17 October that the [private keys for eight intermediate certificates](https://www.news18.com/tech/emudhra-certificate-authority-keys-hacked-8-certificates-blocked-by-chrome-firefox-apple-and-microsoft-all-details-explained-10390802.html) from India’s eMudhra were weak enough to recover, which would let an attacker issue trusted certificates for any website. Mozilla and Chrome confirmed the problem on 20 October and moved to block the affected certificates. eMudhra says the keys were created during a April 2025 ceremony, that its root keys were not affected, and it is leaving the global [SSL certificate](https://www.digicert.com/what-is-an-ssl-certificate) business. [Read CSO’s report](https://www.csoonline.com/article/4238338/google-mozilla-revoke-emudhra-intermediates-after-private-key-compromise.html) ## North Korean group Lazarus targets South Korean firms with a new campaign! Kaspersky published details on 21 October of Operation FlashHole, a Lazarus espionage campaign that has been running since July 2025\. It has hit at least three South Korean organisations in construction, software and telecom equipment. _The attackers used phishing, a fake GitHub Pages site and a legitimate Korean security plug-in, and they encrypted parts of the malware with post-quantum cryptography._ [Read BleepingComputer’s report](https://bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery) ## Japanese web firewall flaw exploited to take over servers! [Attackers are exploiting CVE-2026-106931](https://securityaffairs.com/201258/security/japans-siteguard-waf-flaw-cve-2026-106931-is-already-being-exploited.html), a command injection flaw in **SiteGuard Server Edition**, a host-based web application firewall from Japan. The flaw lets attackers run commands with root or SYSTEM privileges, and it sits in a statistics feature that is enabled by default. _Reports from 19 October warned that patching can erase forensic evidence, so administrators should capture logs first_. [Read Security Affairs’ report](https://securityaffairs.com/?p=201258) ![Dmarc Report 8119](https://media.mailhop.org/dmarcreport/dmarc-report-8119-1793101791324.jpg) ## Staffing platform Bullhorn taken offline after a cyberattack! [Bullhorn](https://dysruptionhub.com/bullhorn-massachusetts-cyber-outage/), a cloud platform used by more than **10,000 staffing firms**, detected a cyber incident on 17 October and took its platform offline to contain it. Customers reported disruption to job postings and onboarding for several days, and parts of the service were restored later in the week. Bullhorn has not confirmed whether any customer data was stolen. [Read BleepingComputer’s report](https://bleepingcomputer.com/news/security/bullhorn-takes-staffing-platform-offline-to-contain-cyberattack) ## Nextcloud servers backdoored through a critical Collabora flaw! Attackers have been exploiting **CVE-2026-110447**, a critical command injection flaw in the [built-in CODE server app for Nextcloud](https://www.neoteo.com/en/github-says-cve-2026-110447-differs-from-cve-2025-66208), since 10 September. They plant PHP web shells that survive a restart. _Disabling the app does not close the hole, so administrators should update the app to 26.4.303 or later and check their servers for web shells_. [Read eSecurity Planet’s report](https://www.esecurityplanet.com/threats/news-collabora-nextcloud-cve-2026-110447/) ## Meta smart glasses reportedly recorded conversations without the wake phrase! **Several Ray-Ban Meta** owners reported that their [glasses captured conversations](https://www.pcmag.com/news/meta-admits-its-smart-glasses-briefly-recorded-audio-without-a-wake-phrase) without the “Hey Meta” wake phrase, with some saying the feature was switched off. Meta says the problem has been resolved, though it has not fully explained what caused it. The reports have renewed concerns about recording bystanders without their consent. [Read Malwarebytes’ report](https://www.malwarebytes.com/?p=479053) These incidents also highlight the importance of strong [email security](https://dmarcreport.com/blog/why-email-security-matters-and-how-to-get-it-right/). Implementing [DMARC](https://dmarcreport.com/), [DKIM](https://dmarcreport.com/dmarc-fundamentals/what-is-dkim/), and SPF helps organizations reduce email spoofing and phishing risks as part of a broader [cybersecurity](https://dmarcreport.com/blog/email-security-meets-cybersecurity-understanding-the-role-of-dmarc-reports/) strategy. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) AutoSPF Automatic SPF Flattening Streamline your SPF record management, enable DMARC compliance, and improve your email deliverability by fixing the SPF 10-lookup limitation. [ Fix My SPF Record! → ](https://autospf.com/pricing/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=fix-my-spf) [ See How It Works ](https://autospf.com/how-it-works/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=how-it-works) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F) [ ](https://twitter.com/intent/tweet?text=PHP2Shell%20Flaws%20Patched%2C%20%20Japan%20Cyberattack%20Emergency%2C%20Backup%20Software%20Backdoor&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fphp2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![Cybersecurity Threats Weekly Roundup](https://media.mailhop.org/dmarcreport/dmarc-lookup-2281-1792584391252.jpg) Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads Intermediate ](/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads Oct 21, 2026 ](/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"PHP2Shell Flaws Patched, Japan Cyberattack Emergency, Backup Software Backdoor","description":"Explore major cybersecurity news from October 20–26, 2026, including PHP2Shell flaws, Japan’s cyber emergency, backdoors, breaches, and malware.","url":"https://dmarcreport.com/blog/php2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor/","datePublished":"2026-10-27T00:00:00.000Z","dateModified":"2026-10-27T00:00:00.000Z","dateCreated":"2026-10-27T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 5,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/php2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-lookup-9285-1793101720701.jpg","caption":"PHP2Shell Flaws and Cybersecurity Threats"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"PHP2Shell Flaws Patched, Japan Cyberattack Emergency, Backup Software Backdoor","item":"https://dmarcreport.com/blog/php2shell-flaws-patched-japan-cyberattack-emergency-backup-software-backdoor/"}]} ```