cPGuard update servers hijacked to push backdoor to Linux servers

· Cybersecurity

An attacker broke into the update system of the cPGuard web security suite on November 2 and used it to send a malicious script to customers' Linux servers. According to an advisory from maker OPSSHIELD, the script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, allowing the attacker to steal data. The compromise of a security vendor's own update channel means customers who trusted the software to protect their systems instead received malware through a routine update path, a supply-chain risk that also affects any other downstream users of the tool. The incident is the latest in a series of attacks abusing trusted software update mechanisms.

Why it matters：Compromise of a security vendor's update pipeline undermines trust in auto-update mechanisms broadly, reinforcing calls for signed updates and tighter integrity checks across software supply chains.

Key points

  • The breach occurred on November 2 in cPGuard's update infrastructure.
  • A malicious script installed a backdoor and harvested password hashes.
  • Maker OPSSHIELD disclosed the incident in an advisory.

Sources (original reporting)

More stories from this day