cPGuard Update Infrastructure Hijacked to Push Backdoor, Steal SSH/DB Credentials from ~2,946 Servers
Attackers compromised OpsShield's update distribution CDN for cPGuard, a Linux web-server security suite used alongside cPanel, DirectAdmin, and Plesk, and widely offered by hosts like Namecheap. Using stolen legitimate credentials, the attacker pushed a malicious script via the cPGuard update channel on November 2, 2026 at 02:06 UTC, affecting versions 5.88.12 through 5.88.19. The script harvested root MariaDB/MySQL configuration and root SSH authorization/known-hosts files, exfiltrating the data through a compromised account on OpsShield's licensing server. OpsShield confirmed to BleepingComputer that 2,946 servers were affected, with 32 files stolen per customer on average, and that its own billing database was also copied.
Detalhes técnicos
The attacker gained unauthorized access to OpsShield's CDN using compromised credentials (origin unknown) and used it to distribute a backdoor and data-stealing script disguised as a legitimate cPGuard update. The malicious payload targeted root-level database configuration and SSH credentials, uploading stolen data to OpsShield's own licensing server infrastructure, which the attackers then accessed to retrieve the exfiltrated files. OpsShield detected and halted the malicious distribution within 12 hours, though some servers may have avoided infection due to update-check timing intervals.
Remediação
OpsShield urges all customers to update cPGuard to version 5.88.25 or later, which removes the backdoor and staged malicious files, and to immediately reset passwords and rotate database credentials, cloud secrets, and SSH keys, since stolen credentials remain valid until invalidated. The vendor also plans to release an additional update removing previously installed OpsShield support-access keys as a further precaution.
Linha do tempo
-
cPGuard Update Infrastructure Hijacked to Push Backdoor, Steal SSH/DB Credentials from ~2,946 Servers
ler a análise desta fonte ocultar
Attackers compromised OpsShield's update distribution CDN for cPGuard, a Linux web-server security suite used alongside cPanel, DirectAdmin, and Plesk, and widely offered by hosts like Namecheap. Using stolen legitimate credentials, the attacker pushed a malicious script via the cPGuard update channel on November 2, 2026 at 02:06 UTC, affecting versions 5.88.12 through 5.88.19. The script harvested root MariaDB/MySQL configuration and root SSH authorization/known-hosts files, exfiltrating the data through a compromised account on OpsShield's licensing server. OpsShield confirmed to BleepingComputer that 2,946 servers were affected, with 32 files stolen per customer on average, and that its own billing database was also copied.
Technical Details
The attacker gained unauthorized access to OpsShield's CDN using compromised credentials (origin unknown) and used it to distribute a backdoor and data-stealing script disguised as a legitimate cPGuard update. The malicious payload targeted root-level database configuration and SSH credentials, uploading stolen data to OpsShield's own licensing server infrastructure, which the attackers then accessed to retrieve the exfiltrated files. OpsShield detected and halted the malicious distribution within 12 hours, though some servers may have avoided infection due to update-check timing intervals.
Remediation
OpsShield urges all customers to update cPGuard to version 5.88.25 or later, which removes the backdoor and staged malicious files, and to immediately reset passwords and rotate database credentials, cloud secrets, and SSH keys, since stolen credentials remain valid until invalidated. The vendor also plans to release an additional update removing previously installed OpsShield support-access keys as a further precaution.