[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPIBTXgyavLOCLLfemC8KWu4LEpD-cZVHaEDTCDCAyu4":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"2d25b1db-5a46-492b-94d4-11fcf0443de5","Poisoned cPGuard update hits thousands of web hosting servers","poisoned-cpguard-update-hits-thousands-of-web-hosting-servers-4aaace","An attacker has compromised the update infrastructure of cPGuard, a security suite for Linux web hosting servers, and pushed out a malicious update to nearly 3,000 customer servers. OPSShield, the company behind the security suite, also confirmed that the attacker made off with customer contact information and hashed passwords from the firm’s billing and licensing server. How the attack unfolded The attacker uploaded fake cPGuard updates – versions 5.88.12 through 5.88.19 – to OPSShield’s update … More → The post Poisoned cPGuard update hits thousands of web hosting servers appeared first on Help Net Security.","An attacker compromised the update infrastructure of cPGuard, a security suite for Linux web hosting servers, and distributed a malicious update to nearly 3,000 customer servers. The attacker also exfiltrated customer contact information and hashed passwords from OPSShield's billing and licensing server. The malicious update installed a script that collected sensitive files, including password hashes, SSH keys, and MySQL root passwords, sending them to an attacker-controlled server.","Attacker compromises cPGuard update infrastructure, pushing malicious update to 3,000 servers.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F04\u002Fcpguard-update-supply-chain-compromised\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F04104044\u002Fcpguard-1500.webp","2026-11-04T11:18:23+00:00","2026-11-04T12:00:23.580878+00:00",8,[17,20],{"name":18,"type":19},"cPGuard","product",{"name":21,"type":22},"OPSShield","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":23,"icon":25,"name":26,"slug":27},null,"Supply Chain","supply-chain",[29,31,36,41],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":40,"value":48,"context":49},"cPGuard malicious update","Fake cPGuard updates (versions 5.88.12 through 5.88.19) pushed to customer servers.",[21,18],{"controls":52,"vendors":138},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":83,"name":84,"problem":85,"products":86},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":133,"product_name":134,"url":136,"description":137},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"poisoned-cpguard-update-exposes-thousands-of-hosting-servers","Poisoned cPGuard Update Exposes Thousands of Hosting Servers","An attacker compromised cPGuard's update infrastructure and pushed a malicious update to nearly 3,000 Linux web hosting servers, turning a trusted security tool into a data exfiltration weapon. The malicious script harvested highly sensitive credentials — SSH keys, password hashes, and MySQL root passwords — and sent them to an attacker-controlled server. This incident illustrates the catastrophic trust customers place in software vendors' update pipelines: a single point of failure in the supply chain can simultaneously compromise thousands of downstream environments. The additional breach of OPSShield's billing and licensing server compounded the damage by exposing customer contact information and hashed passwords, underscoring the need to treat update infrastructure as critical, high-value attack surface.",[144,145,146,147,148,149,150],"CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","MITRE ATT&CK T1195.002: Compromise Software Supply Chain","NIS2 Article 21(2)(b)",{"GDPR Article 32":152,"NIS2 Article 21(2)(b)":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"CIS Control 2: Inventory and Control of Software Assets":155,"MITRE ATT&CK T1195.002: Compromise Software Supply Chain":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"The exfiltration of customer contact information and hashed passwords from the billing server constitutes a personal data breach that GDPR Article 32 requires organizations to prevent through appropriate technical security measures.","NIS2 mandates supply chain security measures including policies on secure software development and update integrity, which would have required OPSShield to protect its update infrastructure against exactly this type of compromise.","SI-2 requires organizations to verify the integrity of software updates from vendors, a control that — if applied to cPGuard's update pipeline — would have detected the tampered package.","Maintaining an authoritative inventory of approved software and verifying update integrity would have flagged the unsigned or anomalous cPGuard update before deployment.","The attacker's method of poisoning a legitimate software update to deliver malware to downstream customers is a textbook software supply chain compromise, a technique organizations must specifically model and defend against.","This control requires organizations to assess and manage risks from third-party software, including evaluating the security of vendor update mechanisms before trusting them in production environments.","Applying least-privilege access controls would have prevented the malicious update script from reading SSH keys, password hashes, and MySQL credentials it had no business accessing."]