Attackers Hijack cPGuard Updates to Deploy Backdoor and Steal Server Data
Summary
OpsShield says attackers used compromised credentials to distribute a backdoor and data-stealing script through cPGuard updates from versions 5.88.12–5.88.19. The company reported 2,946 affected servers and advises updating and rotating exposed credentials.
Key points
- OpsShield said an unidentified attacker used compromised credentials to access its update distribution infrastructure on November 2, 2026, and distribute a malicious script through cPGuard updates.
- Affected versions were 5.88.12 through 5.88.19; OpsShield said it stopped the malicious distribution within 12 hours.
- The script targeted Linux password hashes, database configuration, root shell history, and SSH authorization and known-hosts files.
- OpsShield said its investigation found the threat actor retrieved 32 files from each customer; a company spokesperson also said its billing system database was copied.
- The company reported that 2,946 servers were affected. It did not establish what data was collected from each server.
- Administrators are advised to update to cPGuard 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys. OpsShield said the update removes the backdoor and staged files, but exposed credentials must still be invalidated.
Article Details
- Victim Organization
- OpsShield
- Incident Type
- Compromise of cPGuard update distribution infrastructure to deliver a backdoor and data-stealing script
- Incident Date
- 2026-11-02
- Disclosure Date
- 2026-11-03
- Data Types Exposed
- Linux password hashes
- Root database (MariaDB/MySQL) configuration
- Root shell history
- Root SSH authorization and known-hosts files
- OpsShield billing system database
- Affected Records
- OpsShield reported that 2,946 servers were affected. Its investigation found that the threat actor retrieved 32 files from each customer.
- Affected Data Size
- Not disclosed
- Operational Impact
- Compromised cPGuard updates installed a backdoor and staged files on affected servers. OpsShield said it was blocking access and rebuilding affected systems; updating to cPGuard 5.88.25 or later removes the backdoor and staged files.
- Claim Status
- confirmed
MITRE ATT&CK
T1005 · Data from Local SystemThe malicious script targeted password hashes, database configuration, shell history, and SSH files on affected servers.T1078 · Valid AccountsOpsShield said the attacker used compromised legitimate credentials to access its update distribution infrastructure.T1195.002 · Compromise Software Supply ChainThe attacker compromised cPGuard's update distribution infrastructure and used the update channel to distribute a malicious script.