Cpguard
Security incidents tagged Cpguard. Newest first.
1 Cpguard incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 2
- Longest quiet run: 0 days
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- Patched
Attackers hijacked cPGuard's update channel and backdoored about 2,950 Linux hosting servers
OPSSHIELD, maker of the cPGuard web-hosting security suite, says that between Nov 1 and 2 2026 an attacker registered a fake customer account, broke into its billing and licensing server at manage.opsshield.com, stole the keys used to publish updates, and for about 70 minutes on Nov 2 (02:08–03:20 UTC) pushed a malicious cPGuard update (versions 5.88.12–5.88.19). The fake update ran as root on servers that checked for updates in that window, stole /etc/shadow and /etc/passwd, root SSH material, MySQL root credentials, root shell history and some S3 keys, uploaded the loot, and left a hidden root shell. OPSSHIELD estimates about 2,950 customer servers ran the fake update and that about 7,900 billing-portal account records (name, company, address, email, bcrypt password hash) were copied. It says the attacker retrieved 32 collected loot files, revoked the stolen update key, published clean cPGuard 5.88.25/5.88.26 to remove the backdoor, and is rebuilding its billing and licensing systems. Hosts that installed 5.88.12–5.88.19 must treat the server as compromised, update to 5.88.25 or later, rotate root and DB passwords, replace SSH keys, and reset their OPSSHIELD billing password.
OPSSHIELD cPGuard (Linux web hosting security agent)Since Nov 1, 2026
