A sophisticated backdoor has been discovered lurking inside HAProxy builds, putting thousands of organizations and their customers at risk of intercepted web traffic. The “Ted” backdoor, as it’s being called, exploits a vulnerability in HAProxy software to secretly siphon off sensitive data from unsuspecting users.
The discovery was made by security researchers who analyzed various HAProxy build repositories and found that the malicious code had been inserted undetected into several versions of the software. It appears that attackers were able to infiltrate these builds, compromising the integrity of the package, which is widely used for load balancing and proxying web traffic.
HAProxy is an open-source software solution designed to distribute workload across multiple servers, ensuring high availability and performance in web applications. However, its complex architecture makes it vulnerable to privilege escalation attacks. The Ted backdoor exploits this weakness by inserting a malicious module that intercepts and forwards sensitive data, such as usernames, passwords, and credit card numbers.
The attackers likely gained access to HAProxy’s build process through compromised developer credentials or exploited vulnerabilities in the software supply chain. Once inside, they embedded the malicious code without altering the underlying functionality of the application, making it nearly impossible for users to detect the presence of the backdoor. This stealthy approach has allowed the attackers to remain hidden while siphoning off sensitive data from unsuspecting users.
The implications of this discovery are significant, as thousands of organizations rely on HAProxy to secure their web applications and protect customer data. The potential breach routes created by this backdoor could lead to identity exposure and active attack paths, compromising not only the affected organizations but also their customers.
While the exact number of victims is still unknown, it’s clear that the compromised HAProxy builds have been distributed globally, putting countless users at risk. As we’ve seen with previous supply chain attacks, the consequences can be devastating for those affected. To mitigate this risk, organizations should immediately assess their HAProxy deployments and take corrective action to prevent further data breaches.
In light of this discovery, it’s essential for organizations to review their software development lifecycle and ensure that their build processes are secure from potential tampering. Additionally, users should remain vigilant in monitoring their web traffic for suspicious activity and consider implementing additional security measures, such as encryption and access controls, to protect sensitive data.
Source: The Hacker News — 2026-09-04