Attackers compromise the cPGuard web security suite’s autoupdate/update channel and use it to distribute malicious payloads to customers. Multiple outlets report that the attackers poison the update process by gaining access to the update servers, then sending a backdoor script to affected Linux systems.
SecurityWeek, Bleeping Computer, and The Hacker News describe the intrusion as a supply-chain-style attack targeting the update mechanism rather than directly breaching every customer system. The reports say the payload is designed both to install persistent access (a backdoor) and to steal data, including password hashes and other sensitive files. The Hacker News adds that OPSSHIELD’s advisory says the attacker broke into the update system on November 2 and that “some” of the collected data has been taken. The outlets also indicate that affected versions include later releases, with The Hacker News specifically referencing cPGuard 5.88.25 and later.
