Threats · 4h ago
OPSSHIELD said an attacker hijacked cPGuard’s update system on November 2, sending a malicious script in versions 5.88.12 through 5.88.19. By that day, the company estimated the attacker had taken 32 files from its licensing server, each tied to a customer server.
The script came through cPGuard’s normal update channel, installed a backdoor, and collected password hashes, database configuration, shell history, and SSH-related files. Version 5.88.25 or later removes the backdoor and its files, but cannot make copied secrets secret again. An affected-version log entry also cannot show whether the script ran or what data left the server.
OPSSHIELD has not established how many servers ran the script or what was taken from each. If your Linux servers had an affected build, a clean current install may still leave credentials usable and the incident unresolved.
1 source covering this story
cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes
Attackers hijacked cPGuard updates to plant a backdoor and collect server secrets, with 32 files confirmed retrieved from OPSSHIELD's server.
Part of the PlainSec briefing for 2026-11-03