Hackers hijacked the official update channel of cPGuard, a Linux server security tool, and used it to push a malicious script to customer servers that collected root password hashes, SSH keys and database credentials. About 2,950 servers ran the fake update before the attack was stopped, according to the vendor OPSSHIELD.

The incident, disclosed on 3 November 2026, is a supply-chain attack: the attackers did not break into each victim server individually. Instead, they compromised the trusted channel that delivers updates to those servers, and the servers installed the attacker's code themselves, with root privileges.

How the attack unfolded

According to OPSSHIELD's disclosure, the attacker began probing the company's billing portal, manage.opsshield.com, on 1 November, registering a trial account under a false identity at 16:34 UTC. From that account, the attacker reached the billing and licensing server and stole the keys used to publish cPGuard updates.

Between 02:04 and 02:09 UTC on 2 November, the attacker uploaded a malicious update script to the update storage server. Over the next 72 minutes, from 02:08 to 03:20 UTC, automatic update agents on customer servers retrieved and executed the tampered update as root. The poisoned releases were cPGuard versions 5.88.12 through 5.88.19. OPSSHIELD says it detected the attack within 12 hours and stopped further distribution.

An OPSSHIELD spokesperson told BleepingComputer that 2,946 servers were affected, while the company's fuller disclosure rounds the figure to about 2,950. The company has not named the attacker, and says it has not yet established how the credentials used to reach its distribution infrastructure were obtained in the first place.

What the script took

The malicious script targeted the most sensitive files on a Linux server: /etc/shadow and /etc/passwd, root's SSH private keys and other files in /root/.ssh, the MySQL root password stored in /root/.my.cnf, and root's shell history. It also installed a hidden root shell and scheduled tasks to keep access after the update, and sent what it collected back to the attacker through OPSSHIELD's own licensing server, using a compromised account.

The attacker also copied three of OPSSHIELD's cloud servers and the billing records of about 7,900 customer accounts, including names, addresses, email addresses and bcrypt-hashed passwords. OPSSHIELD has published a lookup tool that lets customers check server IP addresses or hostnames against its incident records.

What server owners must do now

OPSSHIELD urges every cPGuard customer to update to version 5.88.25 or later immediately; a further release, 5.88.26, removes the backdoor and revokes OPSSHIELD support access on servers where it had been enabled. But updating alone is not enough. The stolen secrets remain valid until they are changed, so any server that installed an affected version must be treated as compromised even if it now runs a clean release.

Administrators can check whether a server installed one of the poisoned versions by searching the update log with the command grep 'Successfully updated' /opt/cpguard/logs/install_log. Any server that installed versions 5.88.12 to 5.88.19 between 02:08 and 03:20 UTC on 2 November should have its root password, SSH keys, database passwords and any other exposed secrets rotated, and should be checked for the attacker's leftover files, including /var/tmp/.cpg91511_sh and /etc/cron.d/i93677.

cPGuard is widely used by web hosting companies on servers running cPanel, Plesk and DirectAdmin, which is why a single compromised update channel reached thousands of machines in just over an hour. The incident is a sharp reminder that an auto-update channel is one of the most valuable targets in cybercrime: it carries code that runs with full privileges, on systems that trust it completely.