cPGuard Update Channel Compromise Affected Approximately 2,950 Servers
OPSSHIELD confirmed a supply-chain attack on the cPGuard update channel. The malicious update ran with root privileges, collected sensitive data, and left backdoors behind.
The cPGuard compromise affected approximately 2,950 customer Linux servers, according to vendor OPSSHIELD. The attacker gained access to part of the company’s infrastructure and distributed malicious code through a trusted update channel, where it ran with root privileges.
According to OPSSHIELD, the malicious update was delivered on November 2, 2026, between 02:08 and 03:20 UTC. The incident affects cPGuard versions 5.88.12 through 5.88.19. The vendor released clean version 5.88.26 and published indicators of compromise.
cPGuard Compromise and Scope of the Impact
According to OPSSHIELD’s notice, the malicious script collected local password hashes, root SSH material, MySQL and MariaDB configurations, and shell history. In some cases, it may also have obtained cloud keys. The fake update also left backdoors behind.
The company estimates that approximately 2,950 servers ran the malicious package. Citing an OPSSHIELD representative, BleepingComputer independently reported that nearly 3,000 servers were affected and that the billing system database was copied.
OPSSHIELD also reported a leak involving records from approximately 7,900 customer portal accounts. According to the company, these included contact information and hashed passwords.
What Administrators of Affected Servers Should Do
Affected systems should be considered potentially compromised at the root level. Deploying clean version 5.88.26 will remove known implants, but it will not by itself invalidate data the attacker may have previously obtained.
- Verify whether the server installed any version from 5.88.12 through 5.88.19.
- Examine the system from a trusted environment using the published indicators of compromise.
- Update cPGuard to clean version 5.88.26.
- Rotate passwords, SSH keys, database credentials, and cloud API secrets that may have been accessible on the server.
The exact way the attacker gained the ability to run commands on the billing and licensing server remains unclear. OPSSHIELD said it does not have a record of the exact request that enabled the access. The full extent of exfiltration from individual servers, any subsequent misuse of stolen data, and the attacker’s identity have also not been confirmed.
In further information, it will be important to see whether OPSSHIELD clarifies the number of affected systems, publishes the results of its investigation into the entry point, and adds indicators of compromise or server recovery recommendations.
Sources
- OPSSHIELD – Security Incident Disclosure: manage.opsshield.com – Confirms the attack timeline, approximately 2,950 affected servers, customer portal compromise, clean version 5.88.26, and indicators of compromise.
- OPSSHIELD – cPGuard security advisory: Update channel compromise – Confirms the affected versions 5.88.12–5.88.19, the nature of the collected data, backdoors, and the need to rotate credentials.
- BleepingComputer – Hackers hijack cPGuard autoupdate to deploy backdoor, steal data – Independently corroborates the update compromise and OPSSHIELD’s statement about approximately 2,946 affected servers.
Verified and updated: 11/04/2026 06:25
