Do Son 
TL;DR
On November 2, 2026, at 02:06 UTC, an attacker used stolen credentials to break into OPSSHIELD’s update distribution network. In this cPGuard supply chain attack, the intruder then pushed a malicious script to Linux servers through the security product’s own update channel. OPSSHIELD confirms the attacker retrieved data from some customer servers.
cPGuard versions 5.88.12 through 5.88.19 shipped a script that installed a backdoor and stole root credentials. OPSSHIELD estimates the attacker retrieved 32 files, each tied to one customer server. Update to 5.88.25 or later, then rotate every exposed credential.
Why It Matters
cPGuard is a firewall and malware scanner for Linux hosting servers. So the poisoned updates ran on machines that admins trusted to keep attackers out. The script went after the most sensitive files on a server, including password hashes and root SSH keys.
This update channel compromise turned a defensive tool into a delivery vehicle. OPSSHIELD caught the attack within 12 hours. Still, it warns that the timing “does not establish whether data was transferred from servers where the script ran.” Customers also received the warning by email, according to posts on the LowEndSpirit and Portal do Host forums.
How the Attack Works
The attacker did not exploit a software bug. Instead, OPSSHIELD says the intruder “used compromised credentials to gain unauthorized access” to its CDN. From there, the attacker published tampered updates.
The script collected files and staged them in a hidden folder under /var/tmp. Next, it uploaded the data to OPSSHIELD’s own licensing server “under a compromised account for the attacker to retrieve later.” It also left a backdoor shell on servers where it ran.
What the script collected
- /etc/shadow and /etc/passwd
- Root MariaDB/MySQL configuration (my.cnf)
- Root shell history
- Root SSH authorization and known-hosts files
Beyond this data theft and the backdoor, OPSSHIELD has found no other malicious activity so far. However, it calls that finding preliminary.
Affected Versions
cPGuard 5.88.12 through 5.88.19 are affected. To check, search the update log at /opt/cpguard/logs/install_log for “Successfully updated” entries. OPSSHIELD advises that any affected entry means you should “treat it as potentially compromised,” even if the server now runs a fixed version. A missing log does not prove a server is safe.
Patch and Mitigation
- Run
cpgcli update --starton every cPGuard server. - Confirm version 5.88.25 or later with
cpgcli --version. - Reset root and all local account passwords from a trusted recovery environment.
- Rotate database passwords, S3 keys, DigitalOcean tokens and secrets found in root’s shell history.
- Replace SSH keys under /root/.ssh and remove the old public keys everywhere they are trusted.
The update removes the backdoor at /var/tmp/.cpg91511_sh and the staged files. OPSSHIELD is also removing its own support-access keys as a precaution. It does not recommend a full server rebuild for now. Read the full OPSSHIELD cPGuard update channel compromise notice for updates, as the cPGuard supply chain attack investigation continues.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
