● Covered by 3 sources · 3 reportsMedium impact2 negative1 neutral
cPGuard Update System Compromised, Backdoor Deployed to Linux Servers
Key points
- cPGuard update system compromised on November 2 at 02:06 UTC.
- Malicious script distributed to cPGuard versions 5.88.12 through 5.88.19.
- Script installed a backdoor and collected password hashes, sensitive files.
- Data was uploaded to a cPGuard licensing server.
- OPSSHIELD detected the attack within 12 hours and stopped distribution.
- OpsShield is an Indian IT security company.
- Malicious updates were distributed for approximately 70 minutes.
- Approximately 2,950 servers were affected by the malicious updates.
- Attackers used compromised credentials to access the update distribution infrastructure.
- Attackers registered a customer account and ordered a free cPGuard trial.
- Attackers obtained command execution on the billing and licensing server.
- The malicious update was executed as root on affected servers.
Update System Compromise
On November 2, at 02:06 UTC, an unidentified attacker gained unauthorized access to the update distribution infrastructure (CDN) of cPGuard, a Linux web-server security suite. The attacker used compromised credentials to access the system.
This access allowed the attacker to distribute a malicious script through the cPGuard update channel. The affected cPGuard versions were 5.88.12 through 5.88.19.
Malicious Script Functionality
The distributed script installed a backdoor on customer Linux servers. It was designed to collect sensitive information, including password hashes, database configurations, shell history, and SSH files.
The collected data was then uploaded to a cPGuard licensing server. OPSSHIELD, the developer of cPGuard, confirmed that some of this data was exfiltrated by the attacker.
Detection and Remediation
OPSSHIELD detected the compromise and stopped the malicious distribution within 12 hours of the compromised versions being pushed. The company has since cleared its infrastructure credentials and is investigating how the attacker obtained the initial credentials.
cPGuard versions 5.88.25 and later remove the backdoor and any files left by the script. However, OPSSHIELD advises that any server that may have run the script requires new passwords and keys, as credentials copied by the script may still be valid.
Impact and Recommendations
The company has not disclosed the exact number of servers that installed the compromised versions. Due to servers checking for updates at intervals, some may not have received or executed the malicious script.
Admins are urged to update to cPGuard version 5.88.25 or later immediately. Additionally, a full rotation of all credentials and keys on potentially affected servers is recommended to mitigate ongoing risks.
Updates
- OpsShield is an Indian IT security company.
- Malicious updates were distributed for approximately 70 minutes.
- Approximately 2,950 servers were affected by the malicious updates.
- Attackers used compromised credentials to access the update distribution infrastructure.
- Attackers registered a customer account and ordered a free cPGuard trial.
- Attackers obtained command execution on the billing and licensing server.
- The malicious update was executed as root on affected servers.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
OpsShield, an Indian IT security company, experienced a supply chain attack where malicious versions of its cPGuard software were distributed to customers. Attackers gained access to OpsShield's update infrastructure and served compromised updates for approximately 70 minutes, affecting an estimated 2,950 servers and exposing client data.
Attackers compromised the update infrastructure for the cPGuard web security suite, distributing a backdoor and data-stealing script to versions 5.88.12 through 5.88.19. The malicious script targeted Linux password hashes, database configurations, shell history, and SSH files, uploading them to OpsShield's licensing server. OpsShield detected and stopped the distribution within 12 hours, advising users to update to version 5.88.25 or later and rotate credentials.
An attacker compromised the cPGuard security tool's update system on November 2, distributing a malicious script to customer Linux servers. The script installed a backdoor, collected password hashes and sensitive files, and uploaded them to a cPGuard licensing server, necessitating password resets and key rotations for affected systems.