cPGuard update backdoor: attacker stole data from 32 servers, OPSSHIELD says
Attackers used compromised credentials to hijack the update channel of cPGuard, OPSSHIELD's Linux server security tool, on 2 November 2026, distributing malicious versions 5.88.12 to 5.88.19 that installed a backdoor and collected password hashes, database config, root shell history, and root SSH files. OPSSHIELD estimates the attacker retrieved 32 collected files, each tied to one customer server; the estimate is preliminary and does not equal the total of potentially affected servers. The fix is cPGuard 5.88.25 or later, followed by password resets and rotation of keys and tokens.
What happened
On 2 November, attackers used compromised credentials to access OPSSHIELD's update distribution system and push malicious cPGuard versions 5.88.12 to 5.88.19 to customer servers. The script installed a backdoor and collected password hashes, database configurations, root shell history, and root SSH files. OPSSHIELD's preliminary estimate is that the attacker retrieved data from 32 customer servers.
Why it matters
The security tool meant to protect servers became the attack vector. Passwords, database secrets, and SSH keys may have been copied, and credentials already copied remain usable even after cleanup. The 32-server figure is a preliminary count of retrieved data, not the total of potentially affected servers.
What to do
Update every cPGuard server to version 5.88.25 or later and verify the installed version. Treat any server that installed versions 5.88.12 to 5.88.19 as compromised: reset local and root passwords, rotate database passwords, tokens, and secrets, and replace root's private SSH keys.
For the technical team
- Affected
- cPGuard, ferramenta de segurança para servidores Linux da OPSSHIELD · cPGuard versions 5.88.12 through 5.88.19, inclusive. Any server that installed one of these versions should be treated as potentially compromised, even if it now runs 5.88.25 or later.
- Exploitation
- Real attack confirmed by vendor OPSSHIELD, detected within 12 hours of the updates' launch. OPSSHIELD estimates the attacker retrieved 32 collected files, each corresponding to one customer server (preliminary estimate of confirmed retrieval). Per Daily Dark Web, a customer's public EDR account describes successful collection of a root SSH private key from one of its servers.
- Fix
- Update to cPGuard 5.88.25 or later (cpgcli update --start; verify with cpgcli --version). The update removes the known backdoor and staged files but does not invalidate already-copied credentials: reset passwords for root and all password-enabled local Linux accounts from a trusted recovery environment; rotate database passwords, S3 access keys, DigitalOcean tokens, and secrets in root's shell history; replace SSH private keys under /root/.ssh and remove the old public keys from every system that trusts them. OPSSHIELD is also releasing an update to remove its support-access keys. A full server reset or rebuild is not recommended as a routine response.
- Vector
- cPGuard automatic update channel (OPSSHIELD's distribution CDN), compromised with distribution credentials; how the credentials were obtained is under investigation. The malicious script ran as part of updates to versions 5.88.12 through 5.88.19; servers whose update-check interval did not match may not have run it. Collected data was uploaded to OPSSHIELD's own licensing server under a compromised account for the attacker to retrieve later.
- More details
- Attack began 2 November 2026, 02:06 UTC; detected within 12 hours, with the compromised account secured and infrastructure credentials cleared. Exposure check: grep 'Successfully updated' /opt/cpguard/logs/install_log; entries showing 5.88.12 to 5.88.19 confirm installation but not script execution or data transfer, and missing or incomplete logs do not prove the server was unaffected. /etc/shadow hashes are one-way, but simple, common, or previously exposed passwords are easier to recover with offline list testing, so password resets remain necessary.
Timeline
BleepingComputer reports the attackers hijacked cPGuard's automatic update to deploy a backdoor and steal data.
OPSSHIELD details the attack: compromised distribution credentials pushed versions 5.88.12 through 5.88.19 on November 2, harvesting password hashes, database config, shell history and SSH files, and installing a backdoor.
OPSSHIELD published an advisory: the update channel was compromised on November 2 to deliver a script that installed a backdoor and collected password hashes, and the attacker has taken some of the data.
Want the next updates in your inbox? Get the daily edition →
See all 6 updates
New batch reveals the attack vector: the update channel was hijacked to plant a backdoor in versions 5.88.12 to 5.88.19.
Vendor identifies malicious releases 5.88.12 through 5.88.19, whose script stole /etc/shadow, database configs and root's SSH files.
Incident opened.
Sources 6 sources
- CPGuard / OPSSHIELD LLP Breach r/netsec
- @IntCyberDigest @IntCyberDigest
- @TheHackersNews @TheHackersNews
- cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes The Hacker News
- @DailyDarkWeb @DailyDarkWeb
See all 6 sources
- @BleepinComputer @BleepinComputer
