Hijacked cPGuard updates backdoor Linux servers and steal data

An attacker compromised the update system for the cPGuard security tool, breaching credentials at 02:06 UTC on 2 November 2026 and distributing a malicious script to Linux servers running cPGuard versions 5.88.12 through 5.88.19. The backdoor script, described by OPSSHIELD in its advisory, installed a persistent backdoor and exfiltrated sensitive files from affected servers. OPSSHIELD states the attacker has since retrieved some of that data.

The activity was detected within 12 hours of the affected versions being released, and cPGuard’s operators have since cleared their infrastructure credentials and halted the script from contacting additional servers. The advisory notes that it remains unclear how the attacker gained the credentials.

Evidence and scope indicate the script collected specific data from each compromised server, including /etc/shadow, /etc/passwd, root’s database configuration (my[.]cnf), root’s shell history, and SSH authorization and known-hosts files for root. OPSSHIELD estimates that 32 files were taken, each tied to a customer server, though the total number of involved servers is not disclosed.

The script uploaded the gathered data to a licensing server operated by OPSSHIELD, a link now secured. cPGuard 5.88.25 or later patches remove the backdoor and the script’s left-behind files, but credentials from the compromised updates may still be usable, so admins are urged to reset passwords and keys. Admins can verify whether an affected update was installed by checking for “Successfully updated” entries in /opt/cpguard/logs/install_log; any entry for 5.88.12–5.88.19 indicates a potentially compromised server.