Threat watch / Attack
cPGuard: a fake security update, signed in with a stolen key, ran as root on about 2,950 servers
An attacker broke into the billing and licensing server of OPSSHIELD, the vendor of the cPGuard Linux security suite, took the key used to publish updates, and pushed a fake update. For about 70 minutes on 2 November, cPGuard agents installed it as root and sent password hashes, root SSH keys and other secrets to the attacker. OPSSHIELD has disclosed the details and published a clean version.
- Sector
- Tech & SaaS
- Way in
- Supplier
- Product or vendor
- cPGuard
- How it happened
- Through the vendor's billing portal. On 1 November the attacker registered a customer account under a false identity, took a free trial, then sent crafted requests to the portal's callback pages and gained the ability to run commands on the billing and licensing server. From there they took the key that writes to update storage and uploaded a fake update on 2 November. OPSSHIELD says its logs do not record the exact request that gave access, so the precise entry point is not confirmed. Its first advisory spoke of compromised credentials; the later disclosure says a stolen update-storage key.[1][2] Checked 8 Nov 2026
- What was stolen
- From customer servers: password hashes (/etc/shadow and /etc/passwd), root SSH private keys, the MySQL root password where present, root shell history, and cloud storage keys on a small number of servers. From OPSSHIELD: copies of three cloud servers and billing records for about 7,900 accounts (name, company, postal address, email, bcrypt-hashed password). OPSSHIELD's first advisory counted 32 collected files retrieved, each tied to one customer server, and called that a preliminary count.[1][2][3] Checked 8 Nov 2026
- Who was impacted
- About 2,950 customer servers ran the fake update between 02:08 and 03:20 UTC on 2 November. cPGuard versions 5.88.12 to 5.88.19 carried it. OPSSHIELD tells anyone with cPGuard installed and online in that window to assume root-level secrets are compromised. Servers that were offline did not receive it.[1][2][3] Checked 8 Nov 2026
- Threat actor
- Not attributed
Timeline
- The attacker registers a customer account under a false identity and orders a free cPGuard trial. At 22:58 UTC they can run commands on the billing and licensing server. [1]
- The fake update is uploaded to update storage between 02:04 and 02:09 UTC. cPGuard agents install it as root between 02:08 and 03:20 UTC. [1]
- OPSSHIELD revokes the stolen update key and publishes a clean update. [1]
- OPSSHIELD publishes a security advisory with remediation steps, then a full incident disclosure with the timeline. It names no attacker. The Hacker News reports it the same day. [1][2][3]