Malware · Vulnerabilities
Attackers hijack cPGuard updates to backdoor Linux servers and steal credentials
Attackers broke into the cPGuard update system and pushed a malicious script to Linux servers, stealing password hashes and sensitive files. OPSSHIELD has released fixes and urges urgent action.
Ross Grant3 min read
The short version
Attackers managed to break into the update system for cPGuard, a security tool used on Linux servers. They sent out a malicious update that installed a backdoor and stole sensitive data like password hashes and private keys from thousands of servers. The company behind cPGuard has released fixes and is urging all users to update their servers and reset any exposed passwords or keys. If you use cPGuard, you should check your server and take action right away.
By the numbers
- 2,950customer servers ran the malicious scriptThe Hacker News
- 7,900customer billing records accessedThe Hacker News
What happened?
Attackers broke into the cPGuard update system on 2 November 2026 and pushed a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files. OPSSHIELD has released updates to remove the backdoor and urges customers to update and reset credentials. The attacker also accessed billing records for about 7,900 customer accounts.
How the attack worked
On 2 November 2026, an attacker gained access to the update system for cPGuard, a security tool used on Linux servers. According to The Hacker News (opens in a new tab), the attacker used compromised credentials to send out a malicious script as part of official cPGuard updates (versions 5.88.12 through 5.88.19). Servers that installed these updates between 02:08 and 03:20 UTC received the script.
The script installed a backdoor and collected sensitive files, including password hashes and private keys. OPSSHIELD, the maker of cPGuard, said the attack was detected within 12 hours. The company traced the breach to its billing and licensing server and has since secured its infrastructure and stopped the malicious updates from spreading further.
Who is affected
About 2,950 customer servers ran the malicious script, according to OPSSHIELD. The attack targeted Linux servers running affected cPGuard versions. In addition to the servers, OPSSHIELD said the attacker also copied three of its own cloud servers and took billing records for about 7,900 customer accounts.
What was taken
The script collected the following from affected servers:
- /etc/shadow and /etc/passwd (password hashes and user account details)
- Root's SSH private keys and files in /root/.ssh
- MySQL root password from /root/.my.cnf (if present)
- Root's shell history
- On some servers, cloud storage keys from /root/.s3cfg
Password hashes can be cracked offline, especially if weak or reused passwords are used. SSH private keys and cloud storage credentials could allow further access to systems and data.
The response
OPSSHIELD has released updates to remove the backdoor and the scheduled task left by the script. Version 5.88.26 and later are safe. Admins are urged to update all cPGuard servers, check for leftover malicious files, and reset passwords and keys that may have been exposed. The company also provided tools to check if a server was affected and recommends resetting billing portal passwords and enabling two-factor authentication.
OPSSHIELD has not recommended a full system rebuild unless there are signs of further compromise or if the attacker is confirmed to have logged in directly. The investigation is ongoing, and admins are advised to contact OPSSHIELD support if unsure.
What you should do
- Update all cPGuard servers to the latest version.
- Remove any files or scheduled tasks left by the malicious script.
- Reset all passwords and keys that may have been exposed, including root and database credentials.
- Replace SSH keys and review authorised_keys for unknown entries.
- Reset billing portal passwords and enable two-factor authentication.
- Treat any connected systems as potentially exposed until credentials are changed.
Admins can check their update logs for affected versions and should contact OPSSHIELD if they cannot confirm their server's status.
Why it matters
This attack shows how compromising a software update system can let attackers reach many servers at once. Stolen password hashes and keys could be used to break into other systems or accounts. Supply chain attacks like this are hard to detect and can have wide impact.
Key points
- Attackers hijacked the cPGuard update channel to push malware to Linux servers.
- About 2,950 servers ran the malicious script, stealing sensitive credentials.
- Billing records for 7,900 customer accounts were also accessed.
- OPSSHIELD released updates to remove the backdoor and urges urgent action.
- Admins should update, reset credentials, and check for signs of compromise.
Sources
The Hacker News
Reference
