cPGuard supply-chain attack backdoored about 2,950 Linux servers and exposed 7,900 OPSSHIELD customer records

Linha do tempo

1. helpnetsecurity.com ↗ · pub. 04/11/2026 08:18 · coletado 04/11 09:00

   Supply-Chain Attack on cPGuard Update Infrastructure Compromises ~2,950 Web Hosting Servers

   ler a análise desta fonte ocultar

   OPSShield, maker of the Linux web hosting security suite cPGuard, suffered a supply-chain compromise in which an attacker hijacked its update infrastructure and pushed malicious updates (versions 5.88.12–5.88.19) to roughly 2,950 customer servers as root on November 2, 2026. The attacker also breached OPSShield's billing and licensing server, stealing contact information and bcrypt-hashed passwords for about 7,900 customers, and cloned three of the company's cloud servers. The attack chain moved from initial reconnaissance to full compromise in roughly ten hours, which OPSShield attributes to attacker use of AI tooling to accelerate discovery and exploitation. OPSShield has released clean updates, rotated credentials and keys, and published remediation guidance and IOCs for affected customers.

   Technical Details

   The attacker first registered a fake trial account on OPSShield's billing portal to study agent-to-licensing communication, then exploited the billing portal's callback pages to gain remote command execution on the billing/licensing server, from which they exfiltrated customer records. They subsequently obtained an update-storage access key and uploaded fake cPGuard updates that ran as root on customer servers for over 70 minutes, collecting password hashes, root SSH keys, MySQL root passwords, root shell history, and cloud storage keys, exfiltrating them to OPSShield's own compromised licensing server. The malicious payload left a hidden root shell at /var/tmp/.cpg91511_sh with supporting files in /var/tmp/.i93677/. The exact initial access vector into the billing/licensing server remains undetermined; OPSShield has ruled out SSH, control panel, FTP, and API tokens as entry points.

   Remediation

   Affected customers should update to cPGuard v5.88.26 or later, verify removal of the malicious scheduled task and hidden root shell, reset root and local Linux account passwords from a trusted recovery environment, rotate database passwords, S3/DigitalOcean keys and any credentials found in root's shell history or /root/.s3cfg, replace SSH private keys under /root/.ssh, reset OPSShield billing portal passwords, and enable two-factor authentication. Customers confirmed to have had attacker interactive access should rebuild from a clean backup predating November 1. OPSShield has published IOCs and offered remediation assistance.

2. securityweek.com ↗ · pub. 04/11/2026 07:54 · coletado 04/11 09:00

   OpsShield Supply Chain Attack Serves Malicious cPGuard Updates to ~2,950 Servers, Exposes 7,900 Customer Records

   ler a análise desta fonte ocultar

   OpsShield, an Indian IT security firm behind the cPGuard server protection product for Linux web hosting, suffered a supply chain attack in which attackers compromised its billing/licensing infrastructure and pushed malicious updates through the cPGuard CDN. The malicious code was embedded in cPGuard versions 5.88.12–5.88.19 and distributed for roughly 70 minutes before detection within 12 hours. OpsShield estimates about 2,950 servers executed the fake update, and attackers exfiltrated roughly 7,900 client account records (names, company, addresses, emails, hashed passwords) along with 32 files pulled from compromised customer servers. The attackers also deployed a hidden root shell and additional files on affected customer servers and cloned three of OpsShield's cloud servers.

   Technical Details

   The attackers first used a free cPGuard trial to study the licensing/billing portal's communication protocol, then sent crafted requests to gain command execution on the billing and licensing server. Using a stolen access key, they uploaded a malicious update script that ran as root on any server polling OpsShield's update infrastructure during the compromise window. The script collected data and exfiltrated it back to OpsShield's licensing server via a compromised account, while also installing a hidden root shell and dropping files into the temp folder on infected customer servers.

   Remediation

   OpsShield states that all password hashes, root SSH keys, MySQL root passwords, and shell history on infected servers should be considered compromised and rotated. Customers whose servers were not online during the attack window should still reset their billing portal password. OpsShield evicted attackers from affected systems, rotated secrets, removed attacker SSH keys and cloned cloud assets, replaced SSH keys/passwords, reissued all cPGuard license key pairs, reset billing portal sessions and API keys, and is rebuilding its billing, licensing, and internal management servers. A clean update (version 5.88.25 and later) was released to remove the hidden root shell and dropped files, and IoCs were published.

3. bleepingcomputer.com ↗ · pub. 03/11/2026 19:18 · coletado 03/11 21:00

   cPGuard Update Infrastructure Hijacked to Push Backdoor, Steal SSH/DB Credentials from ~2,946 Servers

   ler a análise desta fonte ocultar

   Attackers compromised OpsShield's update distribution CDN for cPGuard, a Linux web-server security suite used alongside cPanel, DirectAdmin, and Plesk, and widely offered by hosts like Namecheap. Using stolen legitimate credentials, the attacker pushed a malicious script via the cPGuard update channel on November 2, 2026 at 02:06 UTC, affecting versions 5.88.12 through 5.88.19. The script harvested root MariaDB/MySQL configuration and root SSH authorization/known-hosts files, exfiltrating the data through a compromised account on OpsShield's licensing server. OpsShield confirmed to BleepingComputer that 2,946 servers were affected, with 32 files stolen per customer on average, and that its own billing database was also copied.

   Technical Details

   The attacker gained unauthorized access to OpsShield's CDN using compromised credentials (origin unknown) and used it to distribute a backdoor and data-stealing script disguised as a legitimate cPGuard update. The malicious payload targeted root-level database configuration and SSH credentials, uploading stolen data to OpsShield's own licensing server infrastructure, which the attackers then accessed to retrieve the exfiltrated files. OpsShield detected and halted the malicious distribution within 12 hours, though some servers may have avoided infection due to update-check timing intervals.

   Remediation

   OpsShield urges all customers to update cPGuard to version 5.88.25 or later, which removes the backdoor and staged malicious files, and to immediately reset passwords and rotate database credentials, cloud secrets, and SSH keys, since stolen credentials remain valid until invalidated. The vendor also plans to release an additional update removing previously installed OpsShield support-access keys as a further precaution.

4. thehackernews.com ↗ · pub. 03/11/2026 12:16 · coletado 03/11 14:00 primeiro registro

   cPGuard Update Channel Hijacked to Deploy Backdoor and Steal Password Hashes from Linux Servers

   ler a análise desta fonte ocultar

   An unidentified attacker compromised the update infrastructure of cPGuard, a Linux security tool made by OPSSHIELD, and used compromised credentials to push a malicious script to customers via versions 5.88.12 through 5.88.19, released starting November 2, 2026 at 02:06 UTC. The script installed a backdoor and exfiltrated /etc/shadow, /etc/passwd, MariaDB/MySQL configuration files, root's shell history, and SSH authorization/known-hosts files to an OPSSHIELD-run licensing server using a compromised account. OPSSHIELD detected the attack within 12 hours, revoked infrastructure credentials, secured the licensing account, and released version 5.88.25 to remove the backdoor and collected files, though stolen credentials may still be valid. OPSSHIELD estimates 32 files were exfiltrated from affected customer servers, a number that may still change, and is still investigating the initial access vector.

   Technical Details

   The malicious script (cpguard-v58812-i91511.sh) dropped a backdoor shell at /var/tmp/.cpg91511_sh and staged stolen data in /var/tmp/.cpg91511/loot.tgz before uploading it to OPSSHIELD's licensing server. Admins can check exposure by running grep 'Successfully updated' /opt/cpguard/logs/install_log to identify affected versions, though a clean log does not guarantee the script did not run, and removal of the backdoor files by updating does not erase evidence it previously executed.

   Remediation

   OPSSHIELD urges all cPGuard admins to run cpgcli update --start and verify cpgcli --version reports 5.88.25 or later. For servers that ran or may have run the script, admins should reset root and local account passwords from a trusted recovery environment, rotate database passwords, S3 keys, DigitalOcean tokens, and any secrets in shell history, and replace SSH private keys under /root/.ssh while removing corresponding public keys elsewhere. OPSSHIELD is also issuing a separate update to strip its support-access SSH keys from customer servers as a precaution, and recommends contacting its support team for case-by-case review rather than a blanket OS rebuild.