Attackers compromised the cPGuard Web Security Suite update infrastructure and used it to distribute backdoors and data-exfiltration scripts. OpsShield, cPGuard’s developer, said the incident began on November 2, 2026, at 02:06 UTC and affected versions 5.88.12 through 5.88.19. The company detected and stopped the malicious distribution within 12 hours of the compromised update being released.
Compromised cPGuard updates targeted server data
According to OpsShield, an unknown attacker accessed its content delivery network using legitimate but compromised credentials. The company has not determined how those credentials were obtained.
“On November 2, 2026, 02:06 UTC, an unknown attacker gained unauthorized access to OpsShield’s update distribution infrastructure (CDN) using compromised credentials,” OpsShield said.
“The attackers used this access to distribute malicious scripts through the cPGard update channel.”
Because cPGuard checks for updates at specific intervals, OpsShield said some servers may have downloaded the malicious script but been unable to execute it. The company could not confirm how many systems were affected in this way.
cPGuard is a Linux web server security suite that includes malware scanning, firewall capabilities and attack protection. Hosting companies and server administrators commonly use it with control panels such as cPanel, DirectAdmin and Plesk. Namecheap also describes cPGuard as a security solution for VPS and dedicated servers.
Users who installed a cPGuard update during the affected period received a script designed to search for sensitive information, including:
- Linux password hashes
- MariaDB and MySQL root database configuration
- Root shell history
- Root SSH authentication data and the known-hosts file
The stolen information was uploaded to OpsShield’s licensing servers through the compromised account, allowing the attackers to retrieve it. OpsShield did not disclose the specific data collected from each server, but evidence gathered during its investigation indicates that the attackers obtained 32 files from each customer.
Nearly 3,000 servers reportedly affected
In a statement to BleepingComputer, an OpsShield representative said the incident affected 2,946 servers. The representative also said the attackers copied information from those systems and accessed the company’s billing-system database.
“We have detected that 2,946 servers have been affected and their information has been copied, as well as our billing system database. We have shut down all access, reconfigured the affected systems and are preparing to make a public announcement as soon as possible,” the representative said.
OpsShield urges customers to rotate credentials
System administrators should update affected cPGuard installations to version 5.88.25 or later, reset passwords and rotate database credentials, cloud secrets and SSH keys that may have been exposed.
OpsShield said installing the latest cPGuard version will remove the backdoor and staged files. However, any stolen credentials should be disabled or replaced as soon as possible, since updating the software alone cannot invalidate credentials that may already have been accessed.
The vendor also plans to release an update that removes previously installed OpsShield support access keys as an additional precaution. Customers should follow the company’s instructions to update cPGuard to version 5.88.25 or later and reset or rotate credentials on potentially compromised servers.
Source: www.bleepingcomputer.com