On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to get into the update distribution system of OPSSHIELD, the company behind the cPGuard Linux web-server security suite, and pushed a malicious script out through the normal cPGuard update channel. The script went out in versions 5.88.12 through 5.88.19. OPSSHIELD says it detected the attack within 12 hours and stopped further distribution, and it is still investigating how the credentials were obtained.
According to OPSSHIELD, the script installed a backdoor shell and collected /etc/shadow and /etc/passwd, root’s MariaDB/MySQL configuration, root’s shell history, and root’s SSH authorization and known-hosts files. It uploaded them to OPSSHIELD’s own licensing server using a compromised account, so the attacker could collect them later. The company says it has confirmed the attacker retrieved some of that data. Its early estimate was 32 customer servers’ files, but it called that a preliminary count of confirmed retrievals, not the total number of affected servers. A company spokesperson later told BleepingComputer that 2,946 servers were affected and that its billing system database was also copied. That figure comes from BleepingComputer’s report; it was not in the written advisory we read.
How to check if you’re affected
Affected versions are cPGuard 5.88.12 through 5.88.19, inclusive. The advisory says to check a server’s update history with:
grep 'Successfully updated' /opt/cpguard/logs/install_log
An entry for any version from 5.88.12 through 5.88.19 means the server installed an affected update. That entry alone does not prove the script ran or that data left the server, and a missing or incomplete log does not prove the server was clean. OPSSHIELD says to treat any such server as potentially compromised, even if it now runs a newer version, and to contact OPSSHIELD Support if unsure.
What OPSSHIELD asks administrators to do:
- On every cPGuard server, run
cpgcli update --start, thencpgcli --versionand confirm it reports 5.88.25 or later. The update removes the known backdoor and staged files, but credentials copied earlier may still work. - Where the script ran or may have run, reset the passwords for root and every other local Linux account that uses a password, from a trusted recovery environment, and change any of them that are reused elsewhere.
- Rotate database passwords, S3 access keys, DigitalOcean tokens and any secrets recorded in root’s shell history.
- Replace the SSH private keys under
/root/.sshand remove the matching old public keys from every system that trusts them.
OPSSHIELD is not recommending a full server rebuild as a routine step, and says that assessment is provisional. It also published these indicators: the script cpguard-v58812-i91511.sh, the backdoor shell /var/tmp/.cpg91511_sh, the directory /var/tmp/.cpg91511 and the archive /var/tmp/.cpg91511/loot.tgz. The advisory notes that the absence of these files after cleanup does not show whether the script previously ran.
OPSSHIELD is also releasing a precautionary update that removes its support-access keys from servers where they were added. The advisory does not say whether the private key matching that support key was exposed.