Hackers Compromise cPGuard Update Channel to Install Backdoor
Original title: Hackers Hijacked Linux Hosting Server Security Tool cPGuard and Used it as a Backdoor
Attacker accessed cPGuard distribution infrastructure to distribute malicious script installing backdoor and collecting files from Linux servers.
An attacker compromised the update channel for cPGuard, a security tool used on Linux hosting servers, to distribute a malicious script that installed a backdoor. The script collected files including /etc/shadow, /etc/passwd, root database configs, shell history, and SSH authorization files. The breach began on November 2, 2026, at 02:06 UTC. OPSSHIELD detected the attack within 12 hours, secured the infrastructure, and released update 5.88.25 to remove the backdoor.
Unconfirmed: How those credentials were obtained remains under investigation.
- Malicious script distributed in versions 5.88.12 through 5.88.19.
- Collected data went to OPSSHIELD licensing server under compromised account.
- Attacker retrieved 32 files corresponding to customer servers.
- Update instruction: run cpgcli update --start and check version 5.88.25 or later.
Impact: Backdoor installation and theft of Linux server files
- 1.Install version 5.88.25 or later
- 2.Review update history for affected versions
- 3.Reset passwords and rotate keys
- Vendors
- OPSSHIELD
- Products
- cPGuard
- Malware
- malicious script
From the original article
3 min read at cybersecuritynews.com
An unidentified attacker compromised the update channel for cPGuard, a security tool used on Linux hosting servers, to distribute a malicious script that installed a backdoor and collected sensitive files. OPSSHIELD confirmed that the attacker retrieved some stolen data and urged administrators to install version 5. 88.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.