OpsShield, the developer of the cPGuard Linux web-server security suite, said today that attackers used compromised credentials to break into its update distribution infrastructure and push a backdoor and data-stealing script to servers.
In an alert published today, OpsShield said the attack began on November 2 at 02:06 UTC and affected cPGuard versions 5.88.12 through 5.88.19. The company said it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised versions. Because update checks occur at specific intervals, OpsShield said some servers may not have received or run the malicious script. It remains unclear how the attacker obtained the legitimate credentials.
cPGuard is a Linux web-server security suite offering malware scanning, firewalls and attack protection, commonly used by hosting firms and server administrators alongside control panels such as cPanel, DirectAdmin and Plesk. Namecheap offers it on VPS and dedicated servers. The security product's update channel was targeted; users updating during the compromise window could receive the attacker's script through it.
The malicious script targeted sensitive data on affected machines, including Linux password hashes, root database (MariaDB/MySQL) configuration, root shell history, and root SSH authorization and known-hosts files. The stolen data was uploaded to OpsShield's licensing server through a compromised account, which the attackers then used to retrieve it. OpsShield said it had not established what data was collected from each server, but evidence from its investigation showed the threat actor retrieved 32 files from each customer.
BleepingComputer contacted OpsShield, and a spokesperson said the incident affected nearly three thousand servers. "We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time," the spokesperson said. The company advised customers to update every cPGuard server to version 5.88.25 or later, and to reset passwords and rotate database credentials, cloud secrets and SSH keys.
OpsShield said updating to the latest version removes the backdoor and staged files, but that stolen credentials must be invalidated as soon as possible. It also said it would release an update to remove previously installed OpsShield support-access keys as an extra precaution.
Analysis
Why This Matters
- Administrators who updated during the window may need to treat passwords, database configurations and SSH keys as exposed, and the cleanup goes beyond patching.
- Because the malware arrived through a trusted update channel, the incident shows how a security product's own distribution system can be turned against its users.
- OpsShield says stolen credentials must be invalidated, leaving affected server operators with a broad rotation and reset effort.
Background
cPGuard is a Linux web-server security suite for malware scanning, firewalls and attack protection, sold by OpsShield and offered by Namecheap on VPS and dedicated servers. The incident is a supply-chain compromise: rather than attacking servers directly, the intruders inserted malicious code into the vendor's update distribution, so customers who updated during the window received the attacker's script as though it were a legitimate release.
What to Watch
- OpsShield's planned public announcement: the company said it is blocking access, rebuilding affected systems and preparing a statement, which may clarify how the credentials were obtained.
- Whether affected administrators rotate database credentials, cloud secrets and SSH keys, since OpsShield says updating alone is not enough and stolen credentials must be invalidated.
- Any signs of follow-on intrusions or data misuse, given OpsShield has not established what was taken from each server but found evidence that 32 files were retrieved per customer.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedThe cPGuard update channel was hijacked to deliver a backdoor and data-stealing script.BleepingComputer: “Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.”
- SupportedOpsShield said attackers used compromised credentials to breach its update infrastructure.BleepingComputer: ““On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN),” OpsShield said .”
- SupportedThe malicious script targeted password hashes, database configuration and SSH files.BleepingComputer: “Users updating cPGuard during the compromise window received a script that targeted sensitive data on their machines: Linux password hashes Root database (MariaDB/MySQL) configuration Root shell history Root SSH authorization and known-hosts files”
- SupportedOpsShield’s alert said the attack began on November 2 at 02:06 UTC.BleepingComputer: “OpsShield, the cPGuard developer, published an alert earlier today saying the attack began on November 2 at 02:06 UTC”
- SupportedThe attack affected cPGuard versions 5.88.12 through 5.88.19.BleepingComputer: “and affected versions 5.88.12 through 5.88.19.”
- SupportedOpsShield detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed compromised versions.BleepingComputer: “The vendor says that it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions.”
- SupportedSome servers may not have received or run the malicious script because update checks happen at specific intervals.BleepingComputer: “Although the company could not confirm, it said that some servers may have not received and run the malicious script due to update checks occurring at specific intervals.”
- SupportedIt remains unclear how the attacker obtained the legitimate credentials.BleepingComputer: “The attacker leveraged legitimate credentials to gain initial access, although it remains unclear how they were obtained.”
- SupportedThe stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then used to retrieve it.BleepingComputer: “The stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then used to retrieve it.”
- SupportedOpsShield’s investigation evidence showed the threat actor retrieved 32 files from each customer.BleepingComputer: “the company's evidence from the investigation shows that the threat actor retrieved 32 files from each customer.”
- SupportedA spokesperson said the incident affected nearly three thousand servers.BleepingComputer: “a spokesperson told us that the incident has impacted nearly three thousand servers.”
- SupportedThe spokesperson’s quoted statement says: “We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time,”BleepingComputer: “"We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time," the company representative said.”
