cPGuard Update Channel Hijack: OPSSHIELD cPGuard — malicious update installed backdoor and stole password hashes/SSH keys on ~2,950 Linux servers
Severity: critical · Patch status: partial · Since 2026-11-03
On 2026-11-02 an attacker used compromised credentials, traced to a break-in at OPSSHIELD's billing/licensing server, to hijack cPGuard's update channel and push a malicious script in versions 5.88.12–5.88.19. About 2,950 customer Linux servers ran the script, which installed a backdoor and a cron task and exfiltrated /etc/shadow, /etc/passwd, root SSH private keys, MySQL root credentials, shell history and some S3 keys. The attacker also copied three OPSSHIELD cloud servers and took billing records for ~7,900 accounts. Fixed in 5.88.26 plus a follow-up removing the cron task; OPSSHIELD also removed its support-access SSH keys. Affected servers need credential/key rotation and possible rebuild if hands-on intrusion occurred.
What to do
- Update every cPGuard server (cpgcli update --start) and confirm latest version; verify /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh are removed
- From a trusted environment, reset root and all local account passwords; change MySQL root and database passwords; rotate S3/DigitalOcean keys and any secrets in root shell history
- Replace root SSH private keys, remove old public keys from all trusting systems, review authorized_keys, and treat SSH-reachable servers as exposed
- Reset billing portal password at manage.opsshield.com and enable 2FA
- Rebuild from pre-Nov-1 clean backup if OPSSHIELD confirms hands-on attacker access; contact support if compromise cannot be ruled out
Fixed versions
Sources
All live incidents on Threat Watch
