OPSSHIELD cPGuard: an attacker who registered as a customer reached the vendor's billing and licensing server and shipped a fake update on 2026-11-02 that ran as root on about 2,950 Linux servers, copying root secrets and leaving a root shell and a scheduled task
cPGuard update channel pushed a fake root update to about 2,950 servers on 2 Nov; update, then rotate root secrets
Defender actions
- On every Linux server that ran cPGuard on 2026-11-02, update to the latest version (the disclosure names 5.88.26 as the clean update), confirm that the hidden root shell and the scheduled task the fake update left are gone, then reset root and local passwords from a trusted environment and rotate the root SSH keys, the MySQL root password, any cloud storage keys and every secret in root's shell history; rebuild from a clean backup taken before 1 November any server the vendor tells you the attacker logged in to by hand.
Analysis
OPSSHIELD says the attacker registered a customer account under a false identity on the vendor's billing portal, studied how the cPGuard agent talks to the licensing system with a trial install, sent crafted requests to the portal's callback pages, gained the ability to run commands on the billing and licensing server, took the keys used to publish updates and shipped a fake update for about 70 minutes on 2026-11-02; the vendor's logs do not record the exact request that gave access (OPSSHIELD, 2026-11-03). cPGuard agents installed the fake update between 02:08 and 03:20 UTC, and it ran as root (OPSSHIELD, 2026-11-03). The script copied the local password hashes, root's SSH private keys and authorization files, the MySQL root password and root's shell history back to the attacker, and root's cloud storage keys on a small number of servers; it also left a hidden root shell and a scheduled task (OPSSHIELD, 2026-11-03). The vendor puts the affected servers at about 2,950 and the exposed billing-portal accounts, with name, company, postal address, e-mail and hashed password, at about 7,900 (OPSSHIELD, 2026-11-03). A clean update, 5.88.26, removes the hidden root shell and a follow-up update removes the scheduled task (OPSSHIELD, 2026-11-03), but credentials copied before cleanup may still be usable (OPSSHIELD, 2026-11-03). The shared exposure is every operator of a cPGuard server: BleepingComputer says hosting firms and server administrators commonly run it alongside panels such as cPanel, DirectAdmin and Plesk (BleepingComputer, 2026-11-03).
Cited evidence
The attacker signed up as a customer, used that account to break into our billing and licensing server, took the keys we use to publish updates, and shipped a fake cPGuard update for about 70 minutes on 2 November.
If your server had cPGuard installed and online between 02:08 and 03:20 UTC on 2 November, assume its root-level secrets are known to the attacker.
A successful update removes the known files, but credentials copied before cleanup may still be usable.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.