Poisoned Security Update Exposed Nearly 3,000 Hosting Servers
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Thursday, November 5th, 2026.
Nearly three thousand Linux hosting servers ran a malicious cPGuard update as root after an attacker compromised the vendor’s update infrastructure. Versions 5.88.12 through 5.88.19 were distributed for more than 70 minutes on November 2nd. The script collected sensitive files and planted a hidden root shell. The attacker also copied about seven thousand nine hundred customer records from billing and licensing systems.
Potentially exposed material includes password hashes, root S S H keys, MySQL root passwords, shell history and cloud storage keys. That means an affected server shouldn’t be considered safe simply because a clean update has been installed. It may still be under attacker control, and copied credentials may remain useful elsewhere.
Leaders should prepare for broad credential rotation, customer communication and possible server rebuilds. Defenders should check installed versions and vendor indicators, remove known persistence and rotate every exposed secret from a trusted system.
The larger lesson is that a trusted security update can become a high-privilege distribution channel. Identify every server that received the malicious versions, remove persistence, rotate exposed secrets and rebuild confirmed intrusions from clean backups.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
