Hackers Hijack cPGuard Autoupdate to Deploy Backdoor, Steal Data
OpsShield said the incident affected 2,946 servers and exposed password hashes, SSH keys and database files before the malicious update was stopped.
- On November 2, 2026, an unidentified attacker compromised OpsShield's update infrastructure, distributing a malicious backdoor script through the cPGuard web security suite.
- Leveraging legitimate credentials, the attacker accessed the CDN at 02:06 UTC, pushing compromised versions before the vendor detected and stopped the malicious distribution within 12 hours.
- Data from the investigation shows 2946 servers were impacted, with the threat actor retrieving 32 files from each customer, including Linux password hashes and MariaDB configurations.
- OpsShield advises administrators to update cPGuard to version 5.88.25 or later and reset database credentials, cloud secrets, and SSH keys immediately.
- Some systems may have avoided the malicious script due to update intervals, though users must invalidate stolen credentials to secure systems running alongside cPanel and DirectAdmin.
13 Articles
13 Articles
CSO Online
Network WorldAttackers turned OpsShield's trusted update channel into a supply-chain attack
The kinks in the software supply chain are once again being exposed, with attackers now targeting OpsShield’s update process. This week, threat actors used compromised credentials to push malicious updates out to cPGuard customers. They then accessed data stored on the vendor’s servers and in its billing portal accounts, and made copies of at least three of OpsShield’s cloud servers. The company said in an advisory that it has “shut the attacker…
cPGuard Update Hijack Exposes Root Passwords and Billing Database
Attackers compromised the update infrastructure for the cPGuard security suite on November 2, 2026, using hijacked Content Delivery Network (CDN) credentials to distribute a malicious backdoor to thousands of Linux servers. The incident, which began at 02:06 UTC, allowed threat actors to poison automated updates and exfiltrate sensitive system credentials and billing information. OPSSHIELD, the developer of cPGuard, confirmed that the breach aff…
The cPGuard supply chain attack compromised approximately 2,950 Linux servers after hackers hijacked OpsShield's upgrade infrastructure.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
