cPGuard Autoupdate Hijacked: Backdoor Delivered to ~3,000 Servers, Credential Theft Confirmed
What Happened — On 2 Nov 2026 at 02:06 UTC, attackers who had obtained legitimate OpsShield credentials accessed the cPGuard update distribution infrastructure (a CDN). Using that foothold they injected a malicious script into the autoupdate channel for versions 5.88.12‑5.88.19. Servers that performed an update during the compromise window received the script, which harvested Linux password hashes, MariaDB/MySQL root configuration, root shell history, and SSH authorized‑keys/known‑hosts files. OpsShield detected the abuse, halted the malicious distribution within 12 hours, and released a clean version (5.88.25). The vendor estimates 2,946 servers were affected and that the stolen data was exfiltrated to the licensing server via a compromised account.
Why It Matters for Trust & Control Assurance — The incident demonstrates a failure in the supply‑chain control objective that requires verifiable integrity of third‑party software updates.
Who Is Affected — Hosting firms, VPS providers, and server administrators that deploy cPGuard alongside panels such as cPanel, DirectAdmin, or Plesk.
Recommended Actions
- Upgrade every cPGuard instance to 5.88.25 or later.
- Immediately reset all privileged passwords, rotate database credentials, and regenerate SSH keys.
- Verify that update packages are signed and that signature verification is enforced on all servers.
- Deploy continuous monitoring of vendor update feeds and credential usage to detect future anomalies.
Technical Notes
- Attack vector: stolen vendor credentials used to compromise the CDN‑based update channel.
- Data exfiltrated: Linux /etc/shadow hashes, root DB config files, root shell history, SSH authorized‑keys and known‑hosts.
- Impact: confirmed credential theft on ~2,946 servers; billing system database also copied.
Source: BleepingComputer