Attackers breach cPGuard updates to steal server credentials

On 2 November 2026, at 02:06 UTC, an attacker used stolen credentials to breach OPSSHIELD’s update distribution network and push a tampered script through the cPGuard update channel. OPSSHIELD says the intruder retrieved data from some customer servers and that the affected cPGuard releases—versions 5.88.12 through 5.88.19— shipped a script that installs a backdoor and steals root credentials. The attacker reportedly gathered up to 32 files tied to individual customer servers. OPSSHIELD urges updating to 5.88.25 or later and rotating any exposed credentials.

The compromise transformed a defensive product into a delivery mechanism for sensitive data and backdoor access. The script targeted critical server files, including /etc/shadow and /etc/passwd, root MariaDB/MySQL configuration (my[.]cnf), root shell history, and root SSH authorization/known-hosts files, storing them in a hidden folder under /var/tmp before uploading to OPSSHIELD’s licensing server via a compromised account. A backdoor shell was also left on affected servers.

OPSSHIELD notes that the timing of data transfer remains unproven, and several customers were alerted by email via community posts. Affected organisations should verify the update logs at /opt/cpguard/logs/install_log for “Successfully updated” entries, treat any such entry as potentially compromised, and follow the published patch guidance to verify versions and reset credentials. OPSSHIELD is removing its own support-access keys as a precaution and does not currently call for a full server rebuild.