Attackers compromised the cPGuard web security suite update infrastructure to distribute a backdoor and data theft script.
OpsShield, the developer of cPGuard, issued an alert earlier today stating that the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19.
The vendor claims to have detected the compromise and stopped the malicious distribution within 12 hours after the attacker released the compromised versions of cPGuard.
Although the company could not confirm it, it did say that some servers may not have received and executed the malicious script due to update checks being performed at specific intervals.
The attacker used legitimate credentials to gain initial access, although how they were obtained remains unclear.
“On November 2, 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to the OpsShield update delivery (CDN) infrastructure,” OpsShield said.
“The attacker used this access to distribute a malicious script via the cPGuard update channel.”
cPGuard is a Linux web server security suite offering malware scanning, firewalls, and attack protection.
It is commonly used by hosting companies and server administrators alongside panels such as cPanel, DirectAdmin and Plesk. Namecheap offers it on VPS and dedicated servers.
Users updating cPGuard during the compromise window received a script targeting sensitive data on their machines:
- Linux password hashes
- Configuring the root database (MariaDB/MySQL)
- Root shell history
- SSH Root Authorization and Known Hosts Files
The stolen data was uploaded to OpsShield’s license server via a compromised account, which the attackers then used to recover it.
Although OpsShield has not established what data was collected from each server, evidence from the company’s investigation shows that the threat actor took 32 files from each client.
System administrators are advised to update each cPGuard server to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys.
OpsShield notes that updating to the latest version of cPGuard removes the backdoor and intermediate files; however, stolen credentials should be invalidated as soon as possible.
The vendor also said that, as an added precaution, it would release an update to remove previously installed OpsShield Support Access Keys.
BleepingComputer contacted OpsShield to learn more about the attack, and a spokesperson told us the incident affected nearly three thousand servers.
“We detected that 2946 servers were affected and copied the mentioned information, and the database of our billing system was also copied. We are working on blocking all access, rebuilding the affected systems and preparing a public announcement as soon as possible,” the company representative said.
The company also advises customers to follow the instructions and update cPGuard to version 5.88.25 or later, as well as reset or rotate credentials that may have been exposed on potentially compromised servers.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
