cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes

An attacker hijacked the cPGuard update channel by compromising OPSSHIELD's infrastructure credentials, distributing a malicious script through versions 5.88.12 to 5.88.19 released on November 2, 2026. The script backdoored Linux servers, collected sensitive files including /etc/shadow, /etc/passwd, root's SSH and database configuration files, and uploaded them to OPSSHIELD's own licensing server via a compromised account. The attacker exfiltrated at least 32 customer data files. OPSSHIELD has since revoked access, released a clean version (5.88.25), and advises password and key rotation for potentially affected systems.

AI-extracted · verify before operational use