Attackers hijacked the update channel of cPGuard, a security suite for Linux web hosting servers, and pushed a malicious backdoor to nearly 3,000 customer servers, vendor OPSSHIELD confirmed on 4 November 2026. The incident is a supply-chain compromise: the trusted update mechanism itself was turned into the delivery route for the attack.

Using a stolen access key for the update storage, the attacker uploaded fake updates under versions 5.88.12 through 5.88.19 on 2 November, between about 02:04 and 02:09 UTC. Because cPGuard agents check for updates at intervals and install them with root privileges, every server that checked in during the roughly 70-minute distribution window silently ran the script. OPSSHIELD told BleepingComputer that 2,946 servers were affected, and detected the attack within 12 hours.

What the script did

The script collected sensitive files and sent them to a server controlled by the attacker, including Linux password hashes, root SSH keys, the MySQL root password where present, root shell history and cloud storage keys. It also installed a hidden root shell at /var/tmp/.cpg91511_sh. The vendor estimates the attacker retrieved 32 collected files, each tied to one customer server, but says it has not established what was taken from every affected server. Separately, the attacker took customer contact details and bcrypt-hashed passwords for about 7,900 billing-portal accounts, and copied three of the vendor’s cloud servers.

OPSSHIELD has released clean updates, with version 5.88.25 removing the known backdoor and a clean 5.88.26 build and a follow-up update removing a scheduled task left behind. Updating removes the backdoor, but it does not invalidate stolen credentials: administrators must rotate root passwords, database credentials, cloud tokens and SSH keys. No CVE has been assigned, because this was a compromise of vendor infrastructure rather than a flaw in a cPGuard release.

Sources: Help Net Security, Poisoned cPGuard update hits thousands of web hosting servers, 4 November 2026; eSecurity Planet, Hackers Poison cPGuard Updates, Compromising Nearly 3,000 Servers, 5 November 2026.