Attackers compromised cPGuard’s update infrastructure and pushed a backdoor to customers

OpsShield said hackers compromised cPGuard’s update infrastructure and pushed a backdoor and data-stealing script to customers, with the intrusion beginning Nov. 2, 2026 at 02:06 UTC. “On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN),” the firm said. The intruder used compromised credentials to gain access to OpsShield’s update distribution infrastructure and pushed a malicious script through the cPGuard update channel, though the source of the credentials remains unclear.

OpsShield detected the compromise and halted malicious distribution within 12 hours after OpsShield pushed the versions. The attack affected cPGuard versions 5.88.12 through 5.88.19. cPGuard is a Linux web-server security suite that scans for malware, provides firewalls, and delivers attack protection. Hosting companies and server managers commonly deploy the suite with cPanel, DirectAdmin, and Plesk, and Namecheap offers cPGuard on VPS (virtual private servers) and dedicated servers.

A script that collected Linux password hashes reached customers who updated during the compromise window. It targeted root database configuration for MariaDB/MySQL, the root shell history, root SSH authorization files, and root known-hosts files. The intruders used a compromised account on OpsShield’s licensing server to exfiltrate data, then downloaded it from there.

OpsShield said investigation evidence indicates that 32 files were pulled from every customer by the adversary. The vendor has not confirmed which data was gathered from individual servers. The company reported that the intrusion reached nearly three thousand servers.

The representative said the billing database was copied as well. OpsShield said some servers might not have received or run the malicious script because updates check at set intervals, though this could not be confirmed. All cPGuard servers should run version 5.88.25 or newer, according to the vendor.

Installing the current release removes the backdoor and staged files. Customers must reset passwords and rotate database credentials, cloud secrets, and SSH keys. Customers must revoke exposed credentials immediately. Customers should install version 5.88.25 or newer on cPGuard and reset or rotate any exposed credentials.

As an extra precaution, the vendor plans an update removing installed OpsShield support-access keys.