Hackers compromise cPGuard update system to deploy backdoor and steal data

Attackers compromised the update infrastructure of the cPGuard web security suite to distribute a backdoor and a data-stealing script, BleepingComputer reported. OpsShield, the developer of cPGuard, published an alert stating that the attack began on November 2, 2026, at 02:06 UTC. The incident impacted software versions 5.88.12 through 5.88.19. [1]

OpsShield detected the compromise and halted the malicious distribution within 12 hours after the attackers pushed the compromised cPGuard updates, according to BleepingComputer. Although the company could not confirm full impact, it stated that some servers might not have received or executed the malicious script due to how update checks occur. [1]

A hacker is commonly defined as a person who seeks unauthorized access to a computer system or network, or a skilled programmer, software enthusiast, or security specialist testing vulnerabilities [2]. As FTMQ Security reported earlier, software supply chain and server compromises have recently targeted critical flaws and public repositories to deploy backdoors and establish unauthorized access [3, 4]. [2][3][4]