# SZB-230ae8d1bb: cPGuard says its update system was hacked to distribute malware

WAF vendor cPGuard says its update system was compromised and used to distribute malware, according to a notice on its website. The notice was shared by security reporter Catalin Cimpanu on Bluesky.

- Type: Early warning
- Kind: Malicious package
- Vendor: cPGuard
- Product: cPGuard
- Status: Reported, not confirmed
- Sources: 6 distinct
- First seen: 2026-11-03 10:24 UTC

> No statement or filing from cPGuard has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Check installed cPGuard versions and remove any update obtained during the affected period
- Verify update integrity against cPGuard's official notice before reinstalling
- Rotate credentials for systems that ran cPGuard updates and scan them for malware
- Check cPGuard hosts for unexpected or unverified updates
- Reinstall cPGuard from a known-clean source and verify file hashes
- Rotate credentials stored on systems running cPGuard

## Timeline

- 2026-11-03 10:22 UTC: Made public by Bluesky
- 2026-11-03 10:24 UTC: First seen by cve.now
- 2026-11-04 01:04 UTC: Record last updated

## Evidence (6 sources)

- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/infosec.skyfleet.blue/post/e2vp4r4nzs7kr): “Hackers Hijacked Linux Hosting Server Security Tool cPGuard and Used it as a Backdoor” (+1 more: [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzghjbmidw2d))
- 2026-11-03 · Press · [Catalin Cimpanu on Bluesky](https://bsky.app/profile/campuscodi.risky.biz/post/3mzgdmezb222z): “WAF cPGuard says it's update system was hacked to distribute malware”
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzgpmrm3ju2f): “A trusted software update channel has become the delivery mechanism for a…”
- 2026-11-03 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data/): “Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzgundaya32k))
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzgwjvnm232s): “A major supply-chain security incident has exposed thousands of Linux servers after attackers compromised the update infrastructure of cPGuard, a popular web-server security…”
- 2026-11-04 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzh5qblbnr23): “A reported compromise of the cPGuard software update infrastructure”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-230ae8d1bb&body=https%3A%2F%2Fcve.now%2FSZB-230ae8d1bb%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-230ae8d1bb

### Has cPGuard confirmed it?

Bluesky, Catalin Cimpanu on Bluesky and Bluesky report it. No statement from cPGuard has reached cve.now yet.

Source: https://bsky.app/profile/infosec.skyfleet.blue/post/e2vp4r4nzs7kr, https://bsky.app/profile/campuscodi.risky.biz/post/3mzgdmezb222z, https://bsky.app/profile/undercodenews.bsky.social/post/3mzgpmrm3ju2f, https://www.bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data/, https://bsky.app/profile/undercodenews.bsky.social/post/3mzgwjvnm232s, https://bsky.app/profile/undercodenews.bsky.social/post/3mzh5qblbnr23

### What should cPGuard users do?

Check installed cPGuard versions and remove any update obtained during the affected period. Verify update integrity against cPGuard's official notice before reinstalling. Rotate credentials for systems that ran cPGuard updates and scan them for malware. Check cPGuard hosts for unexpected or unverified updates. Reinstall cPGuard from a known-clean source and verify file hashes. Rotate credentials stored on systems running cPGuard.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-230ae8d1bb
Site guide for agents: https://cve.now/llms.txt