Attackers hijacked the update channel of cPGuard, a security tool for Linux hosting servers, and used it to push a malicious update that ran as root on about 2,950 customer servers. OPSSHIELD, the company behind cPGuard, disclosed the supply chain attack on 3 November 2026 and urged administrators to update immediately.

The attack began on 2 November at 02:06 UTC, when an unidentified attacker used compromised credentials to gain access to OPSSHIELD's update distribution infrastructure. From there, the attacker published a fake update as cPGuard versions 5.88.12 through 5.88.19. Servers that installed it ran a script as root that collected password hashes, SSH keys and database credentials, and planted a backdoor shell.

OPSSHIELD detected the attack within 12 hours, secured the compromised account, cleared its infrastructure credentials and stopped further distribution. The company said the attacker retrieved 32 collected files from its licensing server, each tied to one customer server. It also said about 7,900 billing-portal account records were copied.

How the attackers got in

The first advisory said the attacker used compromised credentials to reach the update CDN. A longer disclosure published the same day gave more detail: between 1 and 2 November the attacker registered a customer account, got into the billing portal at manage.opsshield.com and gained command execution on that server, then took the keys used to publish updates.

The fake update was pushed for about 70 minutes, between 02:08 and 03:20 UTC on 2 November. Any server with cPGuard online in that window should assume its root secrets are exposed, OPSSHIELD said. BleepingComputer reported that an OPSSHIELD spokesperson put the affected count at 2,946 servers.

The script collected Linux account files including /etc/shadow and /etc/passwd, root database configuration, root shell history and root SSH authorisation and known-hosts files. It staged the data in a hidden folder under /var/tmp and uploaded it to OPSSHIELD's own licensing server under a compromised account, for the attacker to retrieve later.

What administrators must do

OPSSHIELD says every customer should update to cPGuard 5.88.25 or later, which removes the backdoor at /var/tmp/.cpg91511_sh and the staged files. A further release, 5.88.26, also removes OPSSHIELD support-access keys from servers where they were added.

Updating alone is not enough. Administrators must also rotate every exposed credential: local passwords, the database root password, root's SSH keys and any secrets in root's shell history. OPSSHIELD warns that the timing of its detection does not establish whether data was transferred from every server where the script ran.

To check exposure, administrators can search the cPGuard install log at /opt/cpguard/logs/install_log for "Successfully updated" entries showing versions 5.88.12 through 5.88.19, or run cpgcli --version to confirm 5.88.25 or later is installed.

The incident is a reminder that the tools meant to protect servers can themselves become the route in. cPGuard is a firewall and malware scanner for cPanel, DirectAdmin, Plesk and standalone Linux servers, and it updates itself on a schedule. That trust in automatic updates is exactly what the attacker exploited. OPSSHIELD says its investigation continues and it has found no other malicious activity so far.

Sources: OPSSHIELD and Cyber Security News.