data-stealing script

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

Attackers compromised the update infrastructure for the cPGuard web security suite, leveraging the autoupdate mechanism to distribute a backdoor and a data-stealing script to existing installations. The incident was reported by BleepingComputer on 2026-11-03. Details regarding the exact compromise vector, the scope of affected customers, and specific data exfiltrated remain unverified and pending official confirmation from cPGuard.