Poisoned cPGuard security updates backdoor nearly 3,000 web hosting servers
November 2, 2026 (November 2, 2026)
cPGuard is a security suite for Linux web hosting servers made by OPSSHIELD, a small company in India. eSecurity Planet reports that on November 1 an attacker signed up for a trial, studied the product's licensing traffic and sent crafted requests to OPSSHIELD's billing portal that let it run commands on the billing and licensing server, where it found a key for the update storage. Between 02:08 and 03:20 UTC on November 2 the attacker pushed malicious versions 5.88.12 to 5.88.19 through cPGuard's own update channel. OPSSHIELD told BleepingComputer that 2,946 servers ran them. The script ran as root, collected Linux password hashes, root SSH keys, database credentials and shell history, and on some servers cloud storage credentials, uploaded them to OPSSHIELD's licensing system for the attacker to collect, and left a hidden root shell. The attacker also copied the billing database, about 7,900 customer records with names, contact details and hashed passwords. OPSSHIELD says it is still working out what was taken from each server.
Why it matters
A security tool runs as root on every server it protects, so whoever controls its updates controls those servers. Here the way in was the vendor's billing portal, not the product itself.
What defenders can take from it
- cPGuard users: update to 5.88.25 or later and check the install log for versions 5.88.12 to 5.88.19.
- On any server that ran those versions, reset Linux and database passwords, replace SSH keys and revoke cloud keys.
- Where an attacker may have logged in interactively, rebuild from a clean backup taken before November 1.
- Keep a list of every vendor agent that runs as root or administrator, since each one is a path for updates.