# Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers · pwn.watch > OPSSHIELD, maker of the cPGuard web-hosting security suite, says that between Nov 1 and 2 2026 an attacker registered a fake customer account, broke into its billing and licensing server at manage.opsshield.com, stole the keys used to publish updates, and for about 70 minutes on Nov 2 (02:08–03:20 UTC) pushed a malicious cPGuard update (versions 5.88.12–5.88.19). The fake update ran as root on servers that checked for updates in that window, stole /etc/shadow and /etc/passwd, root SSH material, MySQL root credentials, root shell history and some S3 keys, uploaded the loot, and left a hidden root shell. OPSSHIELD estimates about 2,950 customer servers ran the fake update and that about 7,900 billing-portal account records (name, company, address, email, bcrypt password hash) were copied. It says the attacker retrieved 32 collected loot files, revoked the stolen update key, published clean cPGuard 5.88.25/5.88.26 to remove the backdoor, and is rebuilding its billing and licensing systems. Hosts that installed 5.88.12–5.88.19 must treat the server as compromised, update to 5.88.25 or later, rotate root and DB passwords, replace SSH keys, and reset their OPSSHIELD billing password. Page: https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026 · generated 2026-11-04T14:30:54.317Z ## Status - Severity: critical · status: live · patch: patched - Product: OPSSHIELD cPGuard (Linux web hosting security agent) - Started: 2026-11-01 - Affected: cPGuard 5.88.12 through 5.88.19 (malicious updates served ~02:08–03:20 UTC on 2026-11-02); OPSSHIELD billing portal accounts at manage.opsshield.com - Fixed in: cPGuard 5.88.25 or later (5.88.26 removes the hidden root shell and follow-up cleans the i93677 task) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026.json - This file: https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: SecurityWeek and Help Net Security report the supply-chain attack; BleepingComputer notes versions 5.88.12–5.88.19 and the data collected. (https://www.securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack/) - 2026-11-03: OPSSHIELD publishes its full disclosure: ~2,950 servers affected, ~7,900 billing accounts copied, attacker retrieved 32 loot files; advises update to 5.88.25+, credential rotation and IoC checks. (https://opsshield.com/notice/cpguard-update-channel-compromise.html) - 2026-11-02: Attacker uploads a fake cPGuard update with a stolen access key; between 02:08 and 03:20 UTC about 2,950 agents install it. OPSSHIELD revokes the key and publishes clean 5.88.26. (https://opsshield.com/notice/security-incident-disclosure-servermanage.html) - 2026-11-01: Attacker probes manage.opsshield.com, registers a fake customer trial, studies the agent, and by 22:58 UTC gains command execution on the billing and licensing server. (https://opsshield.com/notice/security-incident-disclosure-servermanage.html) ## Fix brief # Security brief: Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers Source: https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026 · status: live · severity: critical · updated Nov 4, 2026, 11:40 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is OPSSHIELD, maker of the cPGuard web-hosting security suite, says that between Nov 1 and 2 2026 an attacker registered a fake customer account, broke into its billing and licensing server at manage.opsshield.com, stole the keys used to publish updates, and for about 70 minutes on Nov 2 (02:08–03:20 UTC) pushed a malicious cPGuard update (versions 5.88.12–5.88.19). The fake update ran as root on servers that checked for updates in that window, stole /etc/shadow and /etc/passwd, root SSH material, MySQL root credentials, root shell history and some S3 keys, uploaded the loot, and left a hidden root shell. OPSSHIELD estimates about 2,950 customer servers ran the fake update and that about 7,900 billing-portal account records (name, company, address, email, bcrypt password hash) were copied. It says the attacker retrieved 32 collected loot files, revoked the stolen update key, published clean cPGuard 5.88.25/5.88.26 to remove the backdoor, and is rebuilding its billing and licensing systems. Hosts that installed 5.88.12–5.88.19 must treat the server as compromised, update to 5.88.25 or later, rotate root and DB passwords, replace SSH keys, and reset their OPSSHIELD billing password. Severity detail: Malicious signed update ran as root on ~2,950 servers; password hashes, SSH keys and DB credentials stolen; ~7,900 billing accounts copied - Product: OPSSHIELD cPGuard (Linux web hosting security agent) ## Affected versions - cPGuard 5.88.12 through 5.88.19 (malicious updates served ~02:08–03:20 UTC on 2026-11-02) - OPSSHIELD billing portal accounts at manage.opsshield.com ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - cPGuard 5.88.25 or later (5.88.26 removes the hidden root shell and follow-up cleans the i93677 task) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes On every cPGuard host: run `cpgcli update --start` and confirm 5.88.25+, then check that `/etc/cron.d/i93677`, `/var/tmp/.i93677/` and `/var/tmp/.cpg91511_sh` are gone. Grep install_log for 5.88.12–5.88.19. If any of those versions installed, rotate root and all local passwords, replace root SSH keys, change MySQL root and any secrets in root shell history or `.s3cfg`, and reset the OPSSHIELD billing password with 2FA. Rebuild from a pre-Nov 1 backup if OPSSHIELD told you the attacker logged in by hand. ## Latest updates - Nov 4, 2026: SecurityWeek and Help Net Security report the supply-chain attack; BleepingComputer notes versions 5.88.12–5.88.19 and the data collected. - Nov 3, 2026: OPSSHIELD publishes its full disclosure: ~2,950 servers affected, ~7,900 billing accounts copied, attacker retrieved 32 loot files; advises update to 5.88.25+, credential rotation and IoC checks. - Nov 2, 2026: Attacker uploads a fake cPGuard update with a stolen access key; between 02:08 and 03:20 UTC about 2,950 agents install it. OPSSHIELD revokes the key and publishes clean 5.88.26. - Nov 1, 2026: Attacker probes manage.opsshield.com, registers a fake customer trial, studies the agent, and by 22:58 UTC gains command execution on the billing and licensing server. ## Advisories - [Security Incident Disclosure: manage.opsshield.com](https://opsshield.com/notice/security-incident-disclosure-servermanage.html) (OPSSHIELD) - [cPGuard security advisory: Update channel compromise](https://opsshield.com/notice/cpguard-update-channel-compromise.html) (OPSSHIELD) ## Write-ups & news - [Malicious cPGuard Updates Served in OpsShield Supply Chain Attack](https://www.securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack/) - [Hackers hijack cPGuard autoupdate to deploy backdoor, steal data](https://www.bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data/) --- Machine-readable: https://pwn.watch/i/cpguard-opsshield-update-channel-compromise-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.