cPGuard update hijack left Linux server credentials exposed
OPSSHIELD said an attacker hijacked cPGuard’s update system on November 2, sending a malicious script in versions 5.88.12 through 5.88.19. By that day, the company estimated the attacker had taken 32 files from its licensing server, each tied to a customer server.
The script came through cPGuard’s normal update channel, installed a backdoor, and collected password hashes, database configuration, shell history, and SSH-related files. Version 5.88.25 or later removes the backdoor and its files, but cannot make copied secrets secret again. An affected-version log entry also cannot show whether the script ran or what data left the server.
OPSSHIELD has not established how many servers ran the script or what was taken from each. If your Linux servers had an affected build, a clean current install may still leave credentials usable and the incident unresolved.