cPGuard Update Infrastructure Compromised, Backdoor Deployed

4 November 2026 3 min read هدهد تك | Hudhud Tech

Attackers have compromised the update infrastructure for the cPGuard web security suite, distributing a backdoor and a data-stealing script.

OpsShield, the developer of cPGuard, issued an alert on November 3, stating that the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19.

The company reported that it detected the compromise and halted the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions.

OpsShield noted that some servers might not have received and executed the malicious script due to update checks occurring at specific intervals.

The attacker gained initial access using legitimate credentials, although the method of obtaining these credentials remains unclear.

According to OpsShield, “On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN).” The attacker then distributed a malicious script through the cPGuard update channel.

cPGuard is a Linux web-server security suite that provides malware scanning, firewalls, and attack protection. It is commonly used by hosting firms and server administrators alongside control panels like cPanel, DirectAdmin, and Plesk.

During the compromise, users who updated cPGuard received a script that targeted sensitive data on their machines, including:

Linux password hashes
Root database (MariaDB/MySQL) configuration
Root shell history
Root SSH authorization and known-hosts files

The stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then accessed to retrieve the information.

While OpsShield has not confirmed the specific data collected from each server, evidence from the investigation indicates that the threat actor retrieved 32 files from each affected customer.

System administrators are advised to update every cPGuard server to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys.

OpsShield stated that updating to the latest cPGuard version removes the backdoor and staged files; however, stolen credentials must be invalidated as soon as possible.

As an additional precaution, the vendor plans to release an update to remove previously installed OpsShield support-access keys.

OpsShield has reported that nearly three thousand servers were impacted by the incident. A company representative stated, “We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time.”

The company continues to advise customers to follow the instructions to update cPGuard to version 5.88.25 or later and reset or rotate credentials that may have been exposed on potentially compromised servers.

Source: BleepingComputer

What do you think of this story?