ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Published Jun 26, 2026 · updated Oct 27, 2026

What to do

  1. Upgrade to a fixed version: backpropagate 1.2.0, @mcptoolshop/backpropagate 1.2.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

backpropagate

>= 1.1.0, < 1.2.0
1.2.0

Check your project: pip show backpropagate

@mcptoolshop/backpropagate

>= 1.1.0, < 1.2.0
1.2.0

Check your project: npm ls @mcptoolshop/backpropagate --all

Is @mcptoolshop/backpropagate@1.2.0 safe to install? See the upgrade verdict →

Sources

← All critical vulnerabilities