Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers
OPSSHIELD cPGuard (Linux web hosting security agent)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
OPSSHIELD, maker of the cPGuard web-hosting security suite, says that between Nov 1 and 2 2026 an attacker registered a fake customer account, broke into its billing and licensing server at manage.opsshield.com, stole the keys used to publish updates, and for about 70 minutes on Nov 2 (02:08–03:20 UTC) pushed a malicious cPGuard update (versions 5.88.12–5.88.19). The fake update ran as root on servers that checked for updates in that window, stole /etc/shadow and /etc/passwd, root SSH material, MySQL root credentials, root shell history and some S3 keys, uploaded the loot, and left a hidden root shell. OPSSHIELD estimates about 2,950 customer servers ran the fake update and that about 7,900 billing-portal account records (name, company, address, email, bcrypt password hash) were copied. It says the attacker retrieved 32 collected loot files, revoked the stolen update key, published clean cPGuard 5.88.25/5.88.26 to remove the backdoor, and is rebuilding its billing and licensing systems. Hosts that installed 5.88.12–5.88.19 must treat the server as compromised, update to 5.88.25 or later, rotate root and DB passwords, replace SSH keys, and reset their OPSSHIELD billing password.
Why this severity: Malicious signed update ran as root on ~2,950 servers; password hashes, SSH keys and DB credentials stolen; ~7,900 billing accounts copied
- Started
- Nov 1, 2026
Affected
- cPGuard 5.88.12 through 5.88.19 (malicious updates served ~02:08–03:20 UTC on 2026-11-02)
- OPSSHIELD billing portal accounts at manage.opsshield.com
Fixed in
- cPGuard 5.88.25 or later (5.88.26 removes the hidden root shell and follow-up cleans the i93677 task)
Timeline4
SecurityWeek and Help Net Security report the supply-chain attack; BleepingComputer notes versions 5.88.12–5.88.19 and the data collected.
OPSSHIELD publishes its full disclosure: ~2,950 servers affected, ~7,900 billing accounts copied, attacker retrieved 32 loot files; advises update to 5.88.25+, credential rotation and IoC checks.
Attacker uploads a fake cPGuard update with a stolen access key; between 02:08 and 03:20 UTC about 2,950 agents install it. OPSSHIELD revokes the key and publishes clean 5.88.26.
Attacker probes manage.opsshield.com, registers a fake customer trial, studies the agent, and by 22:58 UTC gains command execution on the billing and licensing server.
Advisories2
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
