Compromised updates, exposed gateways and exploited flaws put thousands of systems at risk

A hijacked cPGuard update exposed 2,946 servers to a backdoor and data theft, as attackers also target Node-RED, Barracuda appliances and vulnerable WordPress sites.

Attackers used stolen credentials to hijack the update infrastructure for OpsShield’s cPGuard software and push a malicious package to thousands of hosting servers, according to BleepingComputer. The tainted releases, numbered 5.88.12 through 5.88.19, installed a backdoor and copied password hashes, root shell history, database configuration data and SSH files before sending the stolen material to OpsShield’s licensing server. The company said 2,946 servers were affected and that its billing database was also copied. Administrators are being told to move to version 5.88.25 or later and to assume that passwords, database credentials, cloud secrets and SSH keys may need to be rotated.

A separate campaign is targeting Node-RED installations through CVE-2026-58115, an authentication flaw that can allow a remote attacker to create flows and run commands without logging in. Help Net Security reported that VulnCheck observed a full exploit in a single request, followed by payloads that installed a Linux bot and web shells. Siemens has also warned that Industrial OS devices such as the SIMATIC IoT2050 Advanced are exposed when running Node-RED versions before V4.3.4.1. Security teams are being advised to check whether Node-RED is reachable from outside the network, apply updates where available and look for unknown flows or web shells.

Barracuda has meanwhile warned customers about two vulnerabilities that can be chained to gain root access on several of its gateway products, including the Email Security Gateway, Load Balancer ADC, Message Archiver, WAF Control Centre and Web Security Gateway. According to Barracuda’s advisory, the flaws are an authorisation bypass in ESG and a command-injection issue affecting multiple appliances. The vendor says the issues can only be combined to reach root after access to the management interface, and that the fix depends on the product and firmware branch in use. Administrators are being told to keep management ports off the public internet and to patch promptly, especially where appliances may be several releases behind.

CISA has also now added a WordPress core upgrade flaw to its Known Exploited Vulnerabilities catalogue, confirming that the issue is being actively abused. The weakness affects WordPress Core versions before 7.1.4 and can arise during the upgrade process, when files are briefly unpacked into a predictable staging directory under wp-content/upgrade. WordPress released 7.1.4 as a security update, while the Canadian Centre for Cyber Security said CISA added CVE-2026-119977 on 3 November 2026. Wordfence has reported large-scale probing of installer paths, and site owners are being urged to confirm that patched versions are in place, restrict access to the upgrade directory and review logs for suspicious installer requests or new administrator accounts.