cPGuard

Attackers used stolen credentials to push a malicious script through cPGuard’s update channel, collecting password hashes, database configs and SSH files from 2,946 servers. Updating removes the backdoor, but stolen credentials must still be rotated.