OpsShield cPGuard supply chain attack: malicious updates pushed to ~2,950 Linux hosting servers
Severity: high · Patch status: patched · Since 2026-11-02
An attacker first used a free trial account to reach OpsShield's billing and licensing server at manage.opsshield.com, and by 1 Nov 2026 22:58 UTC could run commands there. Using a stolen access key, they uploaded malicious cPGuard 5.88.12 through 5.88.19 to the update storage at 02:04-02:09 UTC on 2 Nov 2026. Agents that polled during the roughly 70-minute window (02:08-03:20 UTC) installed the script, which ran as root. It copied /etc/shadow and /etc/passwd, root SSH keys, the MySQL root config, root shell history, and on a small number of servers S3 keys, then left a setuid root shell at /var/tmp/.cpg91511sh and a scheduled task. The vendor counts about 2,950 servers that ran the update and about 7,900 billing-portal account records (name, company, postal address, email, bcrypt hash) copied. The collected files were uploaded to the vendor's own licensing server, and the attacker has retrieved 32 per-server bundles so far (preliminary). The entry point into the billing system is not yet established. Clean release 5.88.26 removes the root shell, and a follow-up update removes the i93677 scheduled task. The vendor cites no CVE.
What to do
- Update cPGuard to 5.88.26 or later (the vendor's 3 Nov advisory names 5.88.25 as the minimum corrective version) and verify with cpgcli --version
- Confirm /etc/cron.d/i93677, /var/tmp/.i93677/, /var/tmp/.cpg91511_sh and /var/tmp/.cpg91511/ are gone; delete them if not
- Treat any server that had cPGuard online between 02:08 and 03:20 UTC on 2 Nov 2026 as exposed: reset root and all password-enabled local Linux account passwords from a trusted recovery environment
- Rotate the MySQL root password (including /root/.my.cnf), S3 keys in /root/.s3cfg, DigitalOcean tokens, and any secret in root shell history
- Replace SSH private keys under /root/.ssh and remove the old public keys from authorized_keys on every system that trusted them; treat hosts reached from this server with those keys as exposed
- Reset the manage.opsshield.com billing portal password and enable two-factor login, even if cPGuard was offline during the window
- Rebuild from a clean backup taken before 1 Nov 2026 only if the vendor confirms a manual login or the server's integrity cannot be established (the vendor's two notices differ on routine rebuilds; the 3 Nov advisory does not recommend a routine rebuild)
Fixed versions
Sources
All live incidents on Threat Watch
