Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-230ae8d1bbEarly warningMalicious packageReported, not confirmed

cPGuard says its update system was hacked to distribute malware

WAF vendor cPGuard says its update system was compromised and used to distribute malware, according to a notice on its website. The notice was shared by security reporter Catalin Cimpanu on Bluesky.

Written by a model from the sources below. Verify against them.

Sources6Reported, not confirmed
Kind
Malicious package
Vendor
cPGuard
Product
cPGuard
Status
Reported, not confirmed
First seen

What to do

  • Check installed cPGuard versions and remove any update obtained during the affected period

  • Verify update integrity against cPGuard's official notice before reinstalling

  • Rotate credentials for systems that ran cPGuard updates and scan them for malware

  • Check cPGuard hosts for unexpected or unverified updates

  • Reinstall cPGuard from a known-clean source and verify file hashes

  • Rotate credentials stored on systems running cPGuard

Timeline

  1. Made public by Bluesky
  2. First seen by cve.now1 day
  3. Record last updated

Evidence 6

  1. Social
    Bluesky
    “Hackers Hijacked Linux Hosting Server Security Tool cPGuard and Used it as a Backdoor”
    +1 more: Bluesky
  2. Press
    Catalin Cimpanu on Bluesky
    “WAF cPGuard says it's update system was hacked to distribute malware”
  3. Social
    Bluesky
    “A trusted software update channel has become the delivery mechanism for a…”
  4. Press
    BleepingComputer
    “Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.”
    +1 more: BleepingComputer on Bluesky
  5. Social
    Bluesky
    “A major supply-chain security incident has exposed thousands of Linux servers after attackers compromised the update infrastructure of cPGuard, a popular web-server security…”
  6. Social
    Bluesky
    “A reported compromise of the cPGuard software update infrastructure”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about SZB-230ae8d1bb

Has cPGuard confirmed it?

Bluesky, Catalin Cimpanu on Bluesky and Bluesky report it. No statement from cPGuard has reached cve.now yet.Source: Bluesky, Catalin Cimpanu on Bluesky, Bluesky, BleepingComputer, Bluesky, Bluesky

What should cPGuard users do?

Check installed cPGuard versions and remove any update obtained during the affected period. Verify update integrity against cPGuard's official notice before reinstalling. Rotate credentials for systems that ran cPGuard updates and scan them for malware. Check cPGuard hosts for unexpected or unverified updates. Reinstall cPGuard from a known-clean source and verify file hashes. Rotate credentials stored on systems running cPGuard.

Sources