Science & Tech · Cybersecurity · 1 hr ago
cPGuard update breach sent a backdoor to Linux servers
An attacker hijacked cPGuard’s update system, which sends software updates to Linux servers.
The breach began on November 2, and affected versions 5.88.12 through 5.88.19 carried a malicious script.
The script installed a backdoor and copied sensitive files, including password hashes, database settings and SSH files.
The stolen data was sent to an OpsShield licensing server, which the attacker accessed; OpsShield told one outlet that 2,946 servers were affected, while its advisory cited 32 files taken and said the investigation was continuing.
The full impact on individual servers remains unclear, and some servers may not have run the script even if they received an affected update.
Admins should update to version 5.88.25 or later, which removes the backdoor and files left behind.
They should also reset passwords and rotate database credentials, cloud secrets and SSH keys that may have been exposed, because updating alone does not invalidate them.
An unidentified attacker hijacked cPGuard’s update infrastructure on November 2 and distributed a malicious script to Linux servers.
The script installed a backdoor and collected password hashes and other sensitive files.
The compromised updates were versions 5.88.12 through 5.88.19, and OpsShield said it stopped the distribution within 12 hours.
OpsShield recommends updating to version 5.88.25 or later and changing passwords, keys and other potentially exposed credentials.
BleepingComputer reported that OpsShield said 2,946 servers were affected, while The Hacker News said the company had not disclosed how many servers installed an affected version.
- Who
- An unidentified attacker targeted OpsShield, the maker of cPGuard, and its customers’ Linux servers.
- What
- The attacker used compromised credentials to hijack the update channel and distribute a backdoor and data-stealing script.
- When
- The attack began on November 2, 2026, at 02:06 UTC.
- Where
- OpsShield’s update distribution infrastructure and customers’ Linux servers.
- Why
- The script collected sensitive data, which was uploaded to an OpsShield licensing server and retrieved by the attacker. The attacker’s broader motive is not stated.
This story does not have two clearly opposing sides.
An attacker used compromised credentials to access OpsShield’s update distribution infrastructure.
OpsShield detected the compromise and stopped the malicious distribution.
OpsShield estimated that the attacker had taken 32 files from its licensing server, each tied to one customer server.
BleepingComputer and The Hacker News published reports about the compromise.
- Affected versions
- cPGuard 5.88.12 through 5.88.19
- Safe version
- 5.88.25 or later
- Attack start
- November 2, 2026, at 02:06 UTC
- Reported affected servers
- 2,946, according to OpsShield’s spokesperson to BleepingComputer
- Files retrieved
- 32 files, each tied to one customer server, according to OpsShield’s estimate reported by The Hacker News
3 sources
What people are saying
On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN)
The attacker used this access to distribute a malicious script through the cPGuard update channel.
We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well.