cPGuard update hijack: OpsShield CDN compromised to push backdoor and data-stealing script to ~2,946 servers
Severity: high · Patch status: patched · Since 2026-11-03
On 2 November 2026 an unidentified attacker used compromised credentials to access OpsShield's update distribution infrastructure (CDN) for cPGuard, a Linux web-server security suite used with cPanel, DirectAdmin, and Plesk, and pushed malicious versions 5.88.12–5.88.19 through the update channel. Servers updating during the ~12-hour window ran a script that stole Linux password hashes, MariaDB/MySQL root configuration, root shell history, and root SSH authorization/known-hosts files, exfiltrating them via OpsShield's licensing server; the vendor says 2,946 servers were affected and its billing database was also copied. Updating to 5.88.25 or later removes the backdoor and staged files, but stolen credentials must be rotated. OpsShield is rebuilding systems and plans a public announcement.
What to do
- Update every cPGuard server to version 5.88.25 or later immediately
- Rotate root, database (MariaDB/MySQL), cloud secrets, and SSH keys on all potentially affected servers
- Reset all passwords on affected hosts and invalidate password hashes by forcing password changes
- Audit root shell history and authorized_keys for persistence or further attacker access
- Check for unexpected access to OpsShield licensing/billing accounts and monitor for credential misuse
Fixed versions
Sources
All live incidents on Threat Watch
