Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

What it is

OpsShield's cPGuard update CDN was used on 2 November 2026 (from 02:06 UTC) to push a backdoor and a data-stealing script to servers running versions 5.88.12 through 5.88.19. cPGuard is a Linux web-server security suite (malware scanning, firewall, attack protection) that hosting firms and administrators run alongside cPanel, DirectAdmin and Plesk. Namecheap offers it on VPS and dedicated servers.

How it works

The attacker used legitimate credentials, obtained in a way OpsShield has not explained, to reach the update distribution infrastructure. They then served a malicious script through the normal update channel. The script targeted:

• Linux password hashes
• root MariaDB/MySQL configuration
• root shell history
• root SSH authorization and known-hosts files

Stolen data was uploaded to OpsShield's licensing server through a compromised account, and the attacker retrieved it from there. OpsShield's investigation shows 32 files retrieved per customer, but it has not established what was collected from each server.

Preconditions / Affected

A server is exposed if it updated cPGuard while the malicious versions were being served. OpsShield says it detected the compromise and stopped distribution within 12 hours. It could not confirm, but said some servers may not have received or run the script because update checks run at set intervals. OpsShield told BleepingComputer that 2,946 servers were affected and that its billing system database was also copied.

What to do

• Update every cPGuard server to 5.88.25 or later. OpsShield says this removes the backdoor and staged files.
• Treat updating as insufficient on its own: invalidate stolen credentials quickly. Reset passwords, rotate database credentials, cloud secrets and SSH keys.
• Expect a further OpsShield update that removes previously installed OpsShield support-access keys. The vendor describes it as an extra precaution.

Because the script read root shell history and SSH files, secrets that appear there and the hosts listed in known-hosts are reasonable places to start the rotation. That scoping is an inference from the data list above, not advice from the page.

Caveats

The initial credential compromise is unexplained. OpsShield has not confirmed which servers ran the script, so any server that updated in the window should be treated as compromised. The vendor says it is still blocking access and rebuilding affected systems, and a public announcement is pending.