A Fake cPGuard Update Ran as Root on Hosting Servers
OPSSHIELD says an attacker used a stolen distribution key to send a malicious cPGuard update to Linux hosting servers on 2 November. The update ran with root privileges. Hosting operators should use their own update records and the vendor’s installation window to identify which machines require incident response. OPSSHIELD incident disclosure
The update and billing incidents have different exposure
OPSSHIELD traced the initial intrusion to its billing and licensing server. It says customer agents installed the fake update between 02:08 and 03:20 UTC on 2 November. The script collected local password hashes, SSH keys and, where present, database credentials and secrets from root’s shell history. It also left a hidden root shell. The vendor estimates roughly 2,950 servers ran the update. It had preliminarily estimated that the attacker retrieved 32 files. Separately, the attacker copied records associated with about 7,900 billing accounts. The vendor says billing passwords were stored as bcrypt hashes. Initial advisory · Detailed disclosure
A clean update cannot rotate stolen credentials
OPSSHIELD revoked the stolen distribution key and published clean builds. Check the corrective version against the advisory, then inspect for the listed shell and scheduled-task artefacts. Preserve relevant logs before cleanup where practical. If a server was online during the delivery window, rotate exposed credentials from a trusted system, replace root SSH keys and remove the old public keys from every system that trusted them. Include database credentials and tokens that could have appeared in shell history. OPSSHIELD also asks customers to reset their billing portal passwords and recommends a clean rebuild where it has identified hands-on attacker access. Vendor recovery and indicators
Update, 8 November 2026
OPSSHIELD’s release notes for cPGuard 5.89.00 say the update channel is now signed and runs on isolated infrastructure. Servers that ran the malicious update still need credential rotation and compromise assessment. cPGuard release notes
