Security Update Backdoored Web Servers, Plus 3 Stories
Trusted updates are supposed to be the boring part of security. You install them, the software gets safer, and everyone moves on. That bargain broke for nearly 3,000 Linux servers this week when an attacker used cPGuard’s own update channel to deliver a backdoor.
That leads today’s brief because it changes what recovery means. We also have Google tying student Search access to school AI controls, stolen cloud credentials creating six-figure AI bills in hours, and an airline-reservation breach that keeps widening.
A security update backdoored web servers
OPSSHIELD says an attacker broke into infrastructure used to license and update cPGuard, a security suite installed on Linux web servers. On November 2, 2026, the attacker pushed malicious cPGuard versions 5.88.12 through 5.88.19. Because the updater runs with root privileges, the script could install a backdoor and collect the files that matter most on a server: Linux password hashes, database configuration, root’s command history, and SSH authorization data.
The company says 2,946 servers installed the affected update. Its investigation is still developing, and installation doesn’t prove every file was collected or retrieved. Still, the official advisory says the attacker did retrieve some uploaded data. That is enough to treat an affected server as compromised, not merely out of date.
Here’s the part I don’t want buried under the reassuring word update: cPGuard 5.88.25 or later removes the known backdoor and staged files, but it can’t make a stolen password, database credential, cloud token, or SSH key secret again. Administrators need to check the update log, install the corrective version, rotate exposed credentials from a trusted system, and review where those SSH keys or database accounts are accepted. If the logs are missing or incomplete, absence of proof is not proof of absence. Annoying, yes. Also true.
This is a software supply-chain attack. The attacker didn’t have to break into each customer’s server separately. Compromising the vendor’s trusted delivery path turned one intrusion into thousands. It is also a reminder that recovery planning has to include credentials and trusted relationships, not just files and backups. Who else trusts the key that was copied? That’s the practical question.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
Google gives schools AI controls, with a large catch
Google says Gemini, Gemini Notebook, Gemini in Classroom, and Google Search will be off by default for K-12 student accounts until school administrators explicitly turn them on. More control sounds like a direct response to the criticism Google received after enabling Gemini for many younger students in August.
But the controls aren’t as independent as the announcement first sounds. Google confirmed to the Associated Press that because Search now has AI deeply integrated into it, a school that rejects Google’s AI tools altogether also loses Google Search for those student accounts.
That isn’t just a feature toggle. Google Classroom is used by 150 million students and teachers worldwide, and many schools have built lessons, devices, and research habits around the company’s ecosystem. An administrator now faces a policy choice with an infrastructure consequence: accept some AI integration, or replace a search tool students may use every day.
I think schools should separate two questions that Google’s product design has bundled together. Do we want AI-guided learning for these students? And what search and research tools should students have? Those questions can have different answers. Google may have a technical reason for integrating AI with Search, but technical integration doesn’t erase the policy tradeoff.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Stolen AI access can create a $100,000 day
Google Threat Intelligence and Mandiant have documented what they call LLMjacking: attackers stealing access to cloud-hosted AI models, then reselling or consuming that capacity while the victim gets the bill. In incidents investigated during 2026, charges exceeded $100,000 in one day and reached $1 million at some organizations before access was cut off.
The mechanism isn’t mysterious. Attackers find an exposed model endpoint or steal credentials such as a cloud service-account key, GitHub personal access token, active session token, or AI API key. They can then enable expensive model services, create fresh access keys, or route other customers’ requests through the victim’s account. One group tested stolen keys with tiny one-token requests, keeping the validation traffic small before opening the throttle.
Ordinary monthly budget reports are badly matched to a bill that can grow in hours. Businesses using cloud AI should scope keys to the specific models and environments that need them, deny unused AI permissions, scan code repositories for secrets, set hard quotas where the provider allows them, and alert on newly enabled model services. A budget alert is useful. A spending cap is better.
The Amadeus reservation breach reaches Singapore Airlines
Singapore Airlines says data from about 46,000 booking records was accessed through Amadeus, the travel-technology provider used for parts of its reservation system. Most affected records included names, booking references, itineraries, and booking class. About 620 records may also have included email addresses, phone numbers, travel-document details, and frequent-flyer numbers. The airline says its own systems weren’t breached, payment data wasn’t accessed, and bookings weren’t changed.
This isn’t limited to one airline. Cathay Pacific previously said roughly 53,000 bookings were affected, with unauthorized access stretching from August 2023 to September 2026. Amadeus says it fixed the vulnerability and found no evidence of payment-data access.
That last point matters, but it doesn’t make the stolen data harmless. A message containing your real itinerary and booking reference can make a fake rebooking request look convincing. Affected travelers should follow their airline’s instructions, use the airline’s site or app directly, and distrust unsolicited messages asking for payment or travel-document details. Everyone else can watch for notices. There is no reason to change an unrelated airline password just because this story exists.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- OPSSHIELD: cPGuard update-channel compromise advisory
- OPSSHIELD: infrastructure incident disclosure
- BleepingComputer: cPGuard auto-update attack
- Google: AI and Search controls for schools
- Associated Press: Google Search access and school AI choices
- Google Threat Intelligence and Mandiant: LLMjacking investigations
- Amadeus: data and vulnerability statement
- CNA: Singapore Airlines booking records affected
- Cathay Pacific: third-party data incident notice
Photo by panumas nikhomkhai on Pexels.
