An attacker has compromised the update infrastructure of cPGuard and pushed out a malicious update to nearly 3,000 customer servers.