cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes Swati KhandelwalNov 03, 2026Web Security / Cyber Attack An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions remove the backdoor and the files the script left. Credentials the script copied may still work after the update, so any server that may have run the script also needs new passwords and keys. At 02:06 UTC, the attacker, who has not been identified, used compromised credentials to get into cPGuard's update system. The script went out in cPGuard versions 5.88.12 through 5.88.19. The attack was detected within 12 hours of those versions going out, according to OPSSHIELD. The company has cleared its infrastructure credentials and stopped the script from reaching more servers. It is still investigating how the attacker got the credentials. OPSSHIELD has not said how many servers installed one of these versions. Servers check for updates at intervals, so some may not have run the script. Admins can check whether a server installed an affected version by searching its update log: grep 'Successfully updated' /opt/cpguard/logs/install_log An entry for any version from 5.88.12 through 5.88.19 means the server installed an affected update. The entry alone does not show that the script ran or that data left the server. The server should still be treated as potentially compromised, even if it now runs 5.88.25 or later. A server with no matching entries, or with a missing or incomplete log, may still have run the script. Admins who are unsure can contact OPSSHIELD Support. The script collected these kinds of data, OPSSHIELD found: /etc/shadow and /etc/passwd, root's MariaDB or MySQL configuration (my.cnf), root's shell history, and the SSH authorization and known-hosts files for root. It may not have collected every file from every server, and the company is still working out what left each one. The /etc/shadow file stores one-way password hashes. Weak, common or previously leaked passwords can be recovered from those hashes by testing guesses offline, and even strong ones still need resetting. Secrets that may sit in the database configuration or shell history have no such hashing to protect them. The script uploaded what it collected to a licensing server run by OPSSHIELD itself, using a compromised account, so the attacker could pick it up later. OPSSHIELD has since secured that account. The attacker took 32 files from that server, each tied to one customer server, OPSSHIELD estimated late on November 2 UTC. The count covers only files known to have been taken, and it may change. It does not show how many servers may be involved in total. Beyond the data collection and the backdoor, OPSSHIELD has found no other malicious activity so far, a finding it says is not final. OPSSHIELD asks admins to update every cPGuard server now and confirm the version: Run cpgcli update --start on each server. Run cpgcli --version and check that it reports 5.88.25 or later. If the update fails or the version is lower, contact OPSSHIELD Support. Admins should also take these steps for any server where the script ran or may have run: From a trusted recovery environment, reset the passwords for root and every other local Linux account that uses a password. From a trusted device, change any of those passwords that are also used on other systems. Rotate the server's database passwords, S3 access keys, DigitalOcean tokens and any secrets recorded in root's shell history. Replace the SSH private keys stored under /root/.ssh, and remove the matching old public keys from every system that trusts them. OPSSHIELD is not recommending a full reset or operating system rebuild as a routine step, and says that view could change as the investigation continues. Admins who find other signs of compromise, or cannot confirm a server is clean, should ask OPSSHIELD Support for a case-by-case review, which may lead to a rebuild. Separately, OPSSHIELD is releasing another update, as a precaution, that removes its support-access keys from cPGuard servers where they were added earlier. Support access is a cPGuard feature customers use to let OPSSHIELD staff into a server for troubleshooting. Granting it adds an SSH public key belonging to OPSSHIELD to the authorized_keys file for root, according to the company's documentation. OPSSHIELD has not said whether the private key that matches its support-access key was exposed in the attack. OPSSHIELD published these file names. The update removes the backdoor shell and the collection directory, so their absence after updating proves nothing about whether the script ran. File: cpguard-v58812-i91511.sh (the malicious script) File: /var/tmp/.cpg91511_sh (backdoor shell) Directory: /var/tmp/.cpg91511 (where the script gathered files) File: /var/tmp/.cpg91511/loot.tgz (archive the script prepared) Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, data breach, linux, Malware, Supply Chain, Web Security Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions AI-Generated Fake Login Pages Are Making Account Takeovers Easier Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Session Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security