--- title: "Security digest: November 2, 2026" url: https://erroneo.us/security/2026-11-02/ description: "November 2, 2026 vulnerability digest: 2 briefs (cPGuard Update Hijack: Root Backdoor on ~2,950…). What to patch and who can relax." type: security-digest-day section: "Security Digest" date_published: 2026-11-02 date_modified: 2026-11-04 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: November 2, 2026 2 editorial briefs. ## Take stock - Act now: cPGuard Update Hijack: Root Backdoor on ~2,950 Servers . Hosting providers, resellers and admins running cPGuard on cPanel, DirectAdmin or Plesk servers that were online on November 2, 2026, plus every OpsShield billing portal account holder. - Check exposure: Node-RED CVE-2026-58115: Open Editors Exploited for RCE . Anyone running Node-RED (standalone, in Docker, on a Raspberry Pi or gateway, or on a Siemens SIMATIC IoT2050 Advanced before V4.3.4.1) whose editor port is reachable from the internet or an untrusted network without adminAuth. - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [cPGuard Update Hijack: Root Backdoor on ~2,950 Servers](https://erroneo.us/security/briefs/cpguard-5-88-update-channel-supply-chain-compromise/index.md): If any server's cPGuard install log shows a version from 5.88.12 to 5.88.19, treat that server's root secrets as stolen: update, remove the backdoor files, and rotate passwords, SSH keys and database credentials today. - **Check exposure** [Node-RED CVE-2026-58115: Open Editors Exploited for RCE](https://erroneo.us/security/briefs/node-red-unauthenticated-flows-cve-2026-58115-exploited/index.md): The CVE names one Siemens device, but the attack is a single unauthenticated POST /flows request that works on any Node-RED editor reachable without adminAuth; if you have one exposed, treat it as compromised, lock it down today and rebuild. ## Known exploited (CISA KEV) None. ## Critical advisories None. --- Source page: https://erroneo.us/security/2026-11-02/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt