OPSSHIELD says attacker hijacked cPGuard update channel to backdoor Linux servers
OPSSHIELD said in an advisory that an attacker broke into the cPGuard update system on November 2 and pushed a malicious script to customers' Linux servers.
Written by a model from the sources below. Verify against them.
- Kind
- Malicious package
- Vendor
- OPSSHIELD
- Product
- cPGuard
- Status
- Reported, not confirmed
- First seen
Summary
OPSSHIELD said in an advisory that an attacker broke into the cPGuard update system on November 2 and pushed a malicious script to customers' Linux servers. The script reportedly installed a backdoor and collected password hashes and other sensitive files, and the attacker has since taken some of that data.
What to do
Update cPGuard to version 5.88.25 or later
Check Linux servers that received the update for an installed backdoor and the malicious script
Rotate passwords on affected servers, since password hashes may have been collected
Review the advisory from OPSSHIELD for indicators of compromise and remediation steps
Timeline
- Made public by r/netsec
- First seen by cve.now1 day
- Record last updated
On X 7
International Cyber Digest@IntCyberDigest‼️ Hackers hijacked the updates of cPGuard, a security tool for Linux hosting servers, and used them to backdoor the servers it was meant to protect. The script grabbed /etc/shadow, database configs and root's SSH files, then parked them on cPGuard's own licensing server. Any server that took versions 5.88.12 to 5.88.19 should be treated as potentially compromised, the vendor says.
sysxplore@sysxploreBREAKING: A Linux security tool just shipped a backdoor to its own customers. cPGuard is a malware scanner and firewall that web hosts install on their Linux servers. On November 2 at 02:06 UTC, an attacker used compromised credentials to get into the update CDN of its maker, OPSSHIELD, and pushed a malicious script through the normal update channel in cPGuard 5.88.12 to 5.88.19. The script dropped a backdoor and collected /etc/shadow, /etc/passwd, root's MySQL config, root's shell history and root's SSH files, then uploaded it all to OPSSHIELD's own licensing server for the attacker to collect later. The company says it caught it within 12 hours, but it estimates files from 32 customer servers were already taken. OPSSHIELD's advice is blunt: "Update every cPGuard server to version 5.88.25 or later immediately." The update removes the backdoor, but any server that installed 5.88.12 to 5.88.19 still needs new root and user passwords, rotated database and cloud keys, and replaced SSH keys.
Mike Kipruto@itsMikeKiprutoHackers compromised cPGuard's update infrastructure and pushed a malicious script to Linux hosting servers running versions 5.88.12–5.88.19. The script was designed to collect password hashes, database configurations, root SSH files and shell history, then upload the data to OPSSHIELD's licensing server. OPSSHIELD confirms the attacker retrieved data corresponding to 32 customer servers. Update to 5.88.25 or later and rotate potentially exposed credentials. opsshield.com/notice/cpguard…
Show 4 more posts
Venkata Satish Guttula 🛰️@snakeyesV1Cybersecurity review | 3 November 2026 1. cPGuard update breach OPSSHIELD says stolen credentials let an attacker push a backdoor through updates on Nov 2. Versions 5.88.12–5.88.19 are affected. Update to 5.88.25 or later, check update logs and rotate exposed credentials. The attacker retrieved some stolen data; the full scope is still under review. opsshield.com/notice/cpguard… 2. Barracuda patches The Nov 2 advisory covers an access-control bypass and command injection. On ESG, the flaws can be chained to gain root access if an attacker can reach the admin interface. Check firmware and patches, and restrict admin access. The advisory does not report active attacks. trust.barracuda.com/security/pre-a… 3. Linux kernel fixes For CVE-2026-98432, Ubuntu lists 26.10 as fixed. Fixes for 22.04, 24.04 and 26.04 LTS remain in -proposed testing. Disabling MPTCP is not a complete fix. Ubuntu describes an unreleased research exploit; its update does not confirm active attacks. ubuntu.com/blog/fixes-ava…
/r/netsec@_r_netsecCPGuard / OPSSHIELD LLP Breach opsshield.com/notice/cpguard…
Web Hosting@webhostingcPGuard Breach: Updating Removes the Backdoor, Not the Stolen Credentials bit.ly/47VzaBK #webhosting
Net Hosting Talk@NetHostingTalkOPSSHIELD has disclosed a security breach involving cPGuard. An attacker compromised its licensing and update systems and distributed a malicious script targeting server credentials. Visit: nethostingtalk.com/threads/2376/ #cPanel #cPGuard #CyberSecurity #Hosting
Evidence 3
- Socialr/netsec
“An unidentified attacker targeted OPSSHIELD, gained unauthorized access to our licensing and update systems, and distributed a malicious script through the cPGuard update channel.”
- PressThe Hacker News
“An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers.”
- SocialMastodon
“OPSSHIELD confirms attackers compromised its cPGuard update channel.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-61849a44e4
Has OPSSHIELD confirmed it?
r/netsec, The Hacker News and Mastodon report it. No statement from OPSSHIELD has reached cve.now yet.Source: r/netsec, The Hacker News, Mastodon
What should OPSSHIELD users do?
Update cPGuard to version 5.88.25 or later. Check Linux servers that received the update for an installed backdoor and the malicious script. Rotate passwords on affected servers, since password hashes may have been collected. Review the advisory from OPSSHIELD for indicators of compromise and remediation steps.