cPGuard Update Compromised Hitting Thousands of Servers
Original title: Poisoned cPGuard update hits thousands of web hosting servers
Attacker pushed malicious cPGuard updates to nearly 3,000 Linux web servers, exfiltrating password hashes and customer data while OPSShield released a clean fix.
OPSShield's cPGuard update infrastructure was compromised on November 2, 2026, distributing fake versions 5.88.12-5.88.19 to about 2,950 customer servers. The attacker collected sensitive files including SSH keys, MySQL passwords and shell history. Stolen data also included contact info and bcrypt-hashed passwords from 7,900 customers. The company has issued a clean update and is investigating.
Unconfirmed: Exact entry point to update key unknown
- Affected nearly 3,000 servers
- Fake updates 5.88.12-5.88.19 installed as root
- Collected root SSH keys, MySQL passwords and shell history
- Stolen 7,900 customers' data
- Clean update 5.88.26 released
Impact: Exfiltration of password hashes, SSH keys and customer data from hosting servers
- 1.Update to cPGuard 5.88.26 or later
- 2.Reset root passwords and SSH keys
- 3.Check for hidden root shell at /var/tmp/.cpg91511_sh
- Vendors
- OPSShield
- Products
- cPGuard
- Victims
- web hosting servers
From the original article
4 min read at helpnetsecurity.com
An attacker has compromised the update infrastructure of cPGuard, a security suite for Linux web hosting servers, and pushed out a malicious update to nearly 3,000 customer servers. OPSShield, the company behind the security suite, also confirmed that the attacker made off with customer contact information and hashed passwords from the firm’s billing and licensing server.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.