{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers · updates",
  "home_page_url": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026",
  "feed_url": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026/feed.json",
  "description": "OPSSHIELD, maker of the cPGuard web-hosting security suite, says that between Nov 1 and 2 2026 an attacker registered a fake customer account, broke into its billing and licensing server at manage.opsshield.com, stole the keys used to publish updates, and for about 70 minutes on Nov 2 (02:08–03:20 UTC) pushed a malicious cPGuard update (versions 5.88.12–5.88.19). The fake update ran as root on servers that checked for updates in that window, stole /etc/shadow and /etc/passwd, root SSH material, MySQL root credentials, root shell history and some S3 keys, uploaded the loot, and left a hidden root shell. OPSSHIELD estimates about 2,950 customer servers ran the fake update and that about 7,900 billing-portal account records (name, company, address, email, bcrypt password hash) were copied. It says the attacker retrieved 32 collected loot files, revoked the stolen update key, published clean cPGuard 5.88.25/5.88.26 to remove the backdoor, and is rebuilding its billing and licensing systems. Hosts that installed 5.88.12–5.88.19 must treat the server as compromised, update to 5.88.25 or later, rotate root and DB passwords, replace SSH keys, and reset their OPSSHIELD billing password.",
  "language": "en",
  "_pwn": {
    "slug": "cpguard-opsshield-update-channel-compromise-nov-2026",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-04-0cbf7ed9",
      "url": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-04-0cbf7ed9",
      "title": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: SecurityWeek and Help Net Security report the supply-chain attack; BleepingComputer notes versions 5.88.12–5.88.19 and the data collected.",
      "content_text": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: SecurityWeek and Help Net Security report the supply-chain attack; BleepingComputer notes versions 5.88.12–5.88.19 and the data collected.\n\nSource: https://www.securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack/",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://www.securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-03-53758b0f",
      "url": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-03-53758b0f",
      "title": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: OPSSHIELD publishes its full disclosure: ~2,950 servers affected, ~7,900 billing accounts copied, attacker retrieved 32 loot files; advises update to 5.88.25+, credential rotation and IoC checks.",
      "content_text": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: OPSSHIELD publishes its full disclosure: ~2,950 servers affected, ~7,900 billing accounts copied, attacker retrieved 32 loot files; advises update to 5.88.25+, credential rotation and IoC checks.\n\nSource: https://opsshield.com/notice/cpguard-update-channel-compromise.html",
      "date_published": "2026-11-03T00:00:00.000Z",
      "external_url": "https://opsshield.com/notice/cpguard-update-channel-compromise.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-02-43692eec",
      "url": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-02-43692eec",
      "title": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: Attacker uploads a fake cPGuard update with a stolen access key; between 02:08 and 03:20 UTC about 2,950 agents install it. OPSSHIELD revokes the key and publishes clean 5.88.26.",
      "content_text": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: Attacker uploads a fake cPGuard update with a stolen access key; between 02:08 and 03:20 UTC about 2,950 agents install it. OPSSHIELD revokes the key and publishes clean 5.88.26.\n\nSource: https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
      "date_published": "2026-11-02T00:00:00.000Z",
      "external_url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-01-e1ec6509",
      "url": "https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026#2026-11-01-e1ec6509",
      "title": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: Attacker probes manage.opsshield.com, registers a fake customer trial, studies the agent, and by 22:58 UTC gains command execution on the billing and licensing server.",
      "content_text": "Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers: Attacker probes manage.opsshield.com, registers a fake customer trial, studies the agent, and by 22:58 UTC gains command execution on the billing and licensing server.\n\nSource: https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
      "date_published": "2026-11-01T00:00:00.000Z",
      "external_url": "https://opsshield.com/notice/security-incident-disclosure-servermanage.html",
      "tags": [
        "critical"
      ]
    }
  ]
}