Hackers breached the cPGuard update system—software used to protect Linux servers—by replacing the update package with a malicious version. Developers confirmed data theft from 32 servers. The total number of affected machines is unknown.

Malicious Update Provided Hidden Server Access

Attackers compromised the cPGuard update channel, causing servers to automatically download and install the altered package. With covert access, the attackers stole passwords, access keys, and database connection credentials.

Exchange, Wallet, and Web3 Infrastructure at Risk

If the compromised software is used by crypto exchanges, wallets, or Web3 projects, attackers could target their internal infrastructure and potentially access user funds.