Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

cPGuard Update Channel Hijacked to Deploy Backdoor

3 sources · 3 articlesFirst reported Updated ()
What's new

November 3: BleepingComputer reports nearly 3,000 servers affected.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Compromised cPGuard update infrastructure distributed backdoor in versions 5.88.12-5.88.19 affecting nearly 3,000 Linux servers; fixed in 5.88.25.

Attackers compromised cPGuard's update distribution infrastructure on November 2, 2026, using stolen credentials to push malicious scripts in versions 5.88.12 through 5.88.19. The scripts installed a backdoor that collected files including /etc/shadow, /etc/passwd, database configs, shell history, and SSH files from Linux hosting servers. Data was exfiltrated to the compromised licensing server. OPSSHIELD detected the breach within 12 hours at 02:06 UTC, secured the system, and released fixed version 5.88.25. The attack impacted nearly 3,000 servers.

Key facts
  • Affected versions: 5.88.12-5.88.19
  • Fixed in version: 5.88.25
  • Detected: November 2, 2026, 02:06 UTC
  • Impacted servers: nearly 3,000
  • Files retrieved: 32
  • Data sent to: compromised licensing server
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 2, 2026Attacker compromises cPGuard update system with stolen credentials · Cyber Security News
  2. Nov 2, 2026Malicious script distribution begins · Cyber Security News
  3. Nov 2, 2026OPSSHIELD detects attack within 12 hours · The Hacker News
  4. Nov 2, 2026Update 5.88.25 released to remove backdoor · BleepingComputer
  5. Nov 3, 2026BleepingComputer reports nearly 3,000 servers impacted · BleepingComputer

What each outlet adds

beyond the shared facts
  • BleepingComputerReports nearly 3,000 servers affected and CDN compromise details
  • The Hacker NewsDetails on data collection to licensing server and version specifics
  • Cyber Security NewsUpdate release instructions and full detection timeline
Vendors
OPSSHIELDOpsShield
Products
cPGuard
Malware
backdoor scriptmalicious script
Victims
nearly three thousand servers
Organizations
Namecheap

Coverage

oldest first · one row per article · UTC
  1. · 19h ago Cyber Security NewsFirst report

    Hackers Compromise cPGuard Update Channel to Install Backdoor

    Attacker accessed cPGuard distribution infrastructure to distribute malicious script installing backdoor and collecting files from Linux servers.

  2. · 13h ago The Hacker News

    cPGuard Update Channel Hijacked to Install Backdoors

    Attacker hijacked cPGuard update system to distribute backdoor in versions 5.88.12-5.88.19 that collected password hashes and other files from Linux servers.

  3. · 6h ago BleepingComputer

    Hackers hijack cPGuard autoupdate to deploy backdoor

    Attackers compromised OpsShield's CDN to distribute a backdoor and data-stealing script through cPGuard updates, affecting nearly 3,000 servers.