cPGuard Update-System Breach Sent Backdoor to Linux Servers and Collected Sensitive Files
Summary
OPSSHIELD says an attacker compromised cPGuard’s update system and sent a malicious script to versions 5.88.12–5.88.19, installing a backdoor and collecting sensitive files. The company estimates 32 files were taken and urges affected servers to update and rotate keys.
Key points
- An unidentified attacker used compromised credentials to access cPGuard’s update system on November 2 and distribute a malicious script in versions 5.88.12 through 5.88.19.
- OPSSHIELD says the script installed a backdoor and collected files including password hashes, database configuration, shell history, and root SSH authorization files.
- OPSSHIELD estimated that the attacker took 32 files from its licensing server, each tied to one customer server; the count may change and does not establish the total number of affected servers.
- The company says cPGuard 5.88.25 and later remove the backdoor and collection files, but copied credentials may remain usable and should be replaced.
- OPSSHIELD detected the attack within 12 hours, secured infrastructure credentials and the compromised licensing account, and stopped further distribution, according to its advisory.
- The company says it has found no other malicious activity so far, but its investigation is ongoing; it has not said whether its support-access private key was exposed.
Article Details
- Victim Organization
- OPSSHIELD
- Incident Type
- Compromise of cPGuard's update system to distribute a malicious script that installed a backdoor and collected sensitive files from customer Linux servers.
- Incident Date
- 2026-11-02
- Data Types Exposed
- Password hashes and account information from /etc/shadow and /etc/passwd
- Root MariaDB or MySQL configuration from my.cnf
- Root shell history
- Root SSH authorized_keys and known_hosts files
- Affected Records
- OPSSHIELD estimated that 32 files were taken from its licensing server, each tied to one customer server. This is not a count of all potentially affected servers.
- Operational Impact
- The malicious script was distributed in cPGuard versions 5.88.12 through 5.88.19. It installed a backdoor and collected files from servers where it ran. OPSSHIELD said it detected the attack within 12 hours, secured the compromised account, and stopped further distribution. The number of servers that installed affected versions is unknown. OPSSHIELD recommends updating and rotating potentially exposed credentials and keys.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
T1005 · Data from Local SystemThe script collected files from affected servers, including password files, database configuration, shell history, and SSH files.T1195.002 · Compromise Software Supply ChainThe attacker compromised cPGuard's update system and used it to distribute a malicious script through software updates.T1552.001 · Credentials In FilesThe collected files included /etc/shadow and other files containing credentials or secrets.