VULNpocalypse
CriticalSupply chainOngoing

cPGuard update channel hijacked to backdoor Linux hosting servers and steal credentials

Attackers pushed a malicious script through cPGuard versions 5.88.12 to 5.88.19, installing a root backdoor and stealing password hashes and keys.

Published
Updated
Fixed in
cPGuard 5.88.26 or later removes the backdoor (5.88.25 was first named as the fix), and a separate follow-up update removes the scheduled task the script left
Exploitation
Yes, OPSSHIELD says the malicious script reached customer servers and about 2,950 servers ran it

What happened

An unidentified attacker used compromised credentials to get into the update distribution infrastructure of OPSSHIELD, the maker of cPGuard, beginning on November 2, 2026 at 02:06 UTC, and used it to push a malicious script through the cPGuard update channel (BleepingComputer, Cyber Security News). The script went out in cPGuard versions 5.88.12 through 5.88.19. OPSSHIELD says it detected the attack within 12 hours, secured the compromised account, cleared infrastructure credentials and stopped further distribution (The Hacker News).

cPGuard is a Linux web-server security suite offering malware scanning, firewalls and attack protection. It is commonly used by hosting firms and server administrators alongside panels such as cPanel, DirectAdmin and Plesk (BleepingComputer).

How the attacker got in. The first advisory said how the credentials were obtained was still under investigation. OPSSHIELD’s later disclosure, posted on November 3, says the attacker registered a customer account under a false identity on November 1 and ordered a free trial. The attacker then sent crafted requests to callback pages on the billing portal and at 22:58 UTC gained command execution on the billing and licensing server. From there the attacker took the key used to publish updates and uploaded the script between 02:04 and 02:09 UTC on November 2. OPSSHIELD’s logs do not record the exact request that gave access, and the company has patched two possible entry points (The Hacker News).

Scale. The Hacker News reports that OPSSHIELD’s later disclosure says about 2,950 customer servers ran the script, and servers installed it between 02:08 and 03:20 UTC on November 2. A server where cPGuard was not online in that window did not receive it (The Hacker News). An OPSSHIELD spokesperson told BleepingComputer that 2946 servers were affected and that the billing system database was also copied (BleepingComputer). OPSSHIELD’s first estimate was that the attacker had retrieved 32 collected files, each tied to one customer server. That figure measured confirmed retrieval at the time, not total exposure (Cyber Security News).

What the script took. According to OPSSHIELD’s later disclosure as reported by The Hacker News, the script read /etc/shadow and /etc/passwd, root’s SSH private keys and other files in /root/.ssh, the MySQL root password in /root/.my.cnf where present, and root’s shell history. On a small number of servers it also read cloud storage keys in /root/.s3cfg (The Hacker News). Earlier coverage described the data as Linux account files, root MariaDB or MySQL configuration, root shell history, and root SSH authorization and known-hosts files, and noted that OPSSHIELD had not established that every file was collected from every server (Cyber Security News).

Where the data went. The first advisory said the data was uploaded to OPSSHIELD’s own licensing server through a compromised account. The later disclosure says the files went to a server the attacker controlled (The Hacker News).

Vendor-side data theft. The attacker also copied three of OPSSHIELD’s cloud servers and took billing records for about 7,900 customer accounts. These include names, company names, postal addresses, email addresses and passwords stored as bcrypt hashes. OPSSHIELD has revoked the stolen update key and its cloud access keys, reset every billing portal session, rotated its billing and reseller API keys, and is rebuilding its billing, licensing and internal servers from clean images. It is reissuing all cPGuard license keys because the attacker holds copies of them (The Hacker News).

Fix version correction. OPSSHIELD first named 5.88.25 as the fix. Its later disclosure says 5.88.26 removes the backdoor, and a separate follow-up update removes a scheduled task the script also left. The Hacker News corrected an earlier claim that 5.88.25 and later removed everything (The Hacker News).

Am I affected?

You are potentially affected if you run cPGuard and your server installed any version from 5.88.12 through 5.88.19. Check the update log:

grep 'Successfully updated' /opt/cpguard/logs/install_log
  • A matching entry means the server installed an affected update. It does not by itself prove the script ran or that data left the server, but the server should still be treated as potentially compromised, even after updating (The Hacker News).
  • No matching entries, or a missing or incomplete log, does not prove the server escaped. If unsure, contact OPSSHIELD Support (The Hacker News, Cyber Security News).
  • OPSSHIELD’s disclosure page offers a lookup of server IP addresses or hostnames against its incident records. A missing record does not prove a server was unaffected (The Hacker News).
  • Every OPSSHIELD customer is also affected by the billing and licensing breach, so billing portal credentials and license keys are in scope.

Indicators published by OPSSHIELD, as reported by The Hacker News. Updates remove the backdoor shell, the collection directory and the scheduled task, so their absence after updating proves nothing about whether the script ran (The Hacker News):

  • Script: cpguard-v58812-i91511.sh and variants ending in b, c and d
  • SHA-256 of cpguard-v58812-i91511.sh: 2c2acd988da531d133d0e17f245c49bf15781278f837543d18c95e8410eabd38
  • SHA-256 of cpguard-v58812-i91511b.sh: ffd7a47f65fa1244429baa936ae94be54676b53d2f88bc39564f24e22011de8a
  • SHA-256 of cpguard-v58812-i91511c.sh: d73919af84bf46de941db85e27fd1abc65701ef9ce6cf33bb27c5397f4a41c26
  • SHA-256 of cpguard-v58812-i91511d.sh: 6add0201e9a3d02de772d561d05e0da86eb1c538686753b7adcc3aedf7366f77
  • Backdoor, a hidden setuid-root shell: /var/tmp/.cpg91511_sh
  • Scheduled task: /etc/cron.d/i93677
  • Task files: /var/tmp/.i93677/
  • Collection directory: /var/tmp/.cpg91511
  • Staged archive: /var/tmp/.cpg91511/loot.tgz
  • Attacker IP, main address according to OPSSHIELD: 94.183.188[.]91

Whether the private key matching OPSSHIELD’s support-access key was exposed is not confirmed (The Hacker News). No CVE has been reported for this incident.

What to do now

  1. Update every cPGuard server: run cpgcli update --start, then cpgcli --version and confirm you are on the latest version (5.88.26 or later per the later disclosure). If the update fails, contact OPSSHIELD Support (The Hacker News, Cyber Security News).
  2. Check that /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh are gone, and delete any that remain. Apply the follow-up update that removes the scheduled task (The Hacker News).
  3. For any server where the script ran or may have run, reset the passwords for root and every other local account that uses a password, from a trusted recovery environment. Also change any of those passwords that are reused on other systems, from a trusted device (The Hacker News).
  4. Rotate the MySQL root password and any database passwords stored in /root/.my.cnf, S3 access keys, DigitalOcean tokens, keys in /root/.s3cfg, and any secrets recorded in root’s shell history (The Hacker News, Cyber Security News).
  5. Replace the SSH private keys under /root/.ssh, remove the matching old public keys from every system that trusts them, and review authorized_keys for entries you do not recognize. Treat other servers reachable with those keys as exposed until the keys are replaced (The Hacker News).
  6. Remember that updating cannot invalidate credentials already copied. Weak, common or reused passwords can be recovered from /etc/shadow hashes by offline guessing, and even strong ones need resetting (The Hacker News, Cyber Security News).
  7. Reset your billing portal password at manage.opsshield.com and turn on two-factor login. Expect your cPGuard license key to be reissued (The Hacker News).
  8. Apply the OPSSHIELD update that removes support-access keys from servers where they were added earlier, and review the root authorized_keys file (The Hacker News).
  9. Decide on rebuilds case by case. OPSSHIELD does not recommend a routine rebuild, and says that could change. If you find other signs of compromise or cannot confirm a server is clean, ask OPSSHIELD Support for a review. If OPSSHIELD tells you the attacker logged in to your server by hand, rebuild it from a clean backup taken before November 1 (The Hacker News).

Sources