Case: attackers hijacked the update channel of cPGuard, a security add-on for panel servers. Fake builds 5.88.12–5.88.19 ran as root on about 2,950 servers (vendor figure), dropped a hidden shell and collected credentials.
Lesson: a security tool's update channel is attack
