Weekend Short: Fake Updates and Fake Invites
It's Saturday, so we're keeping this one short. One threat to be aware of, one tip to act on.
The threat
Researchers found that attackers tampered with the update servers for AOMEI Backupper, a backup tool. For a short window, people checking for updates could have received a backdoor rather than the legitimate file.
We want to be clear about who this affects. It's narrower than it sounds. If you use that specific backup software and updated during that window, it's worth following the vendor's official guidance. If you've never installed it, this one isn't about you.
Two other stories, briefly
There was also a research demonstration of a root exploit in OpenBSD, rated critical. That's aimed at server operators, not home devices, and it's a good example of why patching matters for the people who run systems.
Separately, a phishing campaign used fake event invitations to target research affiliates. The lesson travels well: an unexpected invitation asking you to sign in is a classic phishing setup, wherever you live.
The tip
Update your software from the official app or the vendor's own website. Never follow a link in an email or message telling you to update right now.
If you're unsure whether an update alert is real, close it and go to the vendor's site yourself. That one habit covers a lot of ground.
Back Monday. Take care.
Related reading