Digest · Monday

Security digest: November 2, 2026

2 editorial briefs.

All digests · RSS · Markdown

Take stock

Act now: cPGuard Update Hijack: Root Backdoor on ~2,950 Servers. Hosting providers, resellers and admins running cPGuard on cPanel, DirectAdmin or Plesk servers that were online on November 2, 2026, plus every OpsShield billing portal account holder.
Check exposure: Node-RED CVE-2026-58115: Open Editors Exploited for RCE. Anyone running Node-RED (standalone, in Docker, on a Raspberry Pi or gateway, or on a Siemens SIMATIC IoT2050 Advanced before V4.3.4.1) whose editor port is reachable from the internet or an untrusted network without adminAuth.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

Nov 2, 2026 · Supply-chain compromise

cPGuard Update Hijack: Root Backdoor on ~2,950 Servers

If any server's cPGuard install log shows a version from 5.88.12 to 5.88.19, treat that server's root secrets as stolen: update, remove the backdoor files, and rotate passwords, SSH keys and database credentials today.

Must act: Hosting providers, resellers and admins running cPGuard on cPanel, DirectAdmin or Plesk servers that were online on November 2, 2026, plus every OpsShield billing portal account holder.

Can relax: Anyone not running cPGuard, and cPGuard users whose install logs show no 5.88.12 to 5.88.19 update, though they should still reset their OpsShield portal password.

Run grep 'Successfully updated' /opt/cpguard/logs/install_log on every cPGuard server; any 5.88.12 to 5.88.19 entry means treat the server as compromised, even if it now runs a newer version.
Update with cpgcli update --start, confirm with cpgcli --version, and make sure /etc/cron.d/i93677, /var/tmp/.i93677/, /var/tmp/.cpg91511/ and /var/tmp/.cpg91511_sh are gone.
Change the root password and every local account password, and any password reused elsewhere.

Read the brief →

Check exposure

Nov 2, 2026 · Misconfiguration · CVE-2026-58115

Node-RED CVE-2026-58115: Open Editors Exploited for RCE

The CVE names one Siemens device, but the attack is a single unauthenticated POST /flows request that works on any Node-RED editor reachable without adminAuth; if you have one exposed, treat it as compromised, lock it down today and rebuild.

Must act: Anyone running Node-RED (standalone, in Docker, on a Raspberry Pi or gateway, or on a Siemens SIMATIC IoT2050 Advanced before V4.3.4.1) whose editor port is reachable from the internet or an untrusted network without adminAuth.

Can relax: Teams whose Node-RED editors require a login via adminAuth or an authenticating proxy and are reachable only from trusted networks, and anyone not running Node-RED at all.

Find every Node-RED instance and test whether GET /flows on the editor port (default 1880) returns 200 without credentials.
Take any unauthenticated, internet-reachable editor off the network or firewall it to trusted addresses immediately.
Enable adminAuth in settings.js with a bcrypt hash from node-red admin hash-pw, and set httpNodeAuth for HTTP endpoints.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.