cPGuard, a security suite for Linux web hosting servers made by OpsShield, was turned against its own customers. OpsShield's advisory says that on 2 November 2026 at 02:06 UTC an unidentified attacker used compromised credentials to get into its update distribution infrastructure (CDN) and released fake cPGuard updates, versions 5.88.12 through 5.88.19. OpsShield says it detected the problem within 12 hours of the updates going out.
How many servers: Help Net Security reports that agents installed the fake update on about 2,950 servers and ran it as root; only servers where cPGuard was online during the window received it. OpsShield's advisory gives no total; it says it estimates the attacker retrieved 32 collected files, each from one customer server, as a preliminary count.
What the script collected: according to the advisory, /etc/shadow and /etc/passwd (password hashes), the root MariaDB/MySQL configuration (my.cnf), root shell history and root SSH authorisation and known-hosts files. It uploaded them to OpsShield's own licensing server under a compromised account and left a backdoor shell. OpsShield stresses that this list does not confirm every file was taken from every server. Help Net Security adds that cloud storage keys were also at risk, and that names, addresses, emails and bcrypt-hashed passwords of about 7,900 customers were taken from the billing and licensing server, and three OpsShield cloud servers were copied.
Still unknown: per Help Net Security, OpsShield has not determined how the attacker got the update-storage access key or how they ran commands on the billing server. On the fixed version, sources differ: the advisory says 5.88.25 or later removes the known backdoor and staged files, while Help Net Security says 5.88.26 removes the hidden root shell and a follow-up update removes a scheduled task tied to "i93677". Install the newest release.
