cPGuard Update Compromise: Hijacked Autoupdate Stole Root Secrets From About 2,950 Servers, and What to Rotate This Week
An attacker pushed a fake cPGuard update that ran as root on Linux hosting servers and collected password hashes, SSH keys and database passwords. Here are the affected versions, how to check your server and what to rotate.
Where Worldwide
On this page 8 sections
On Sunday evening, November 1, 2026, US Eastern time, an attacker pushed a fake update through the official update channel of cPGuard. cPGuard is a security suite for Linux web hosting servers, and the fake update ran as root on customer machines. If your company website, online store or client sites run on a server with cPGuard, treat that server's root passwords, SSH keys and database passwords as exposed until you have changed them.
What happened to cPGuard
OPSSHIELD makes cPGuard and sells it as a security product for Linux web hosting servers. It includes malware scanning, automatic cleanup of infected site files, a web application firewall and an IP blocklist. It runs on cPanel/WHM, DirectAdmin, Plesk, Webuzo, CyberPanel and other control panels, or with no control panel at all. Like most security tools, it updates itself automatically. That automatic update is how the attacker got in.
OPSSHIELD has published two documents, both dated Tuesday, November 3, 2026: a customer advisory and a longer security incident disclosure. In plain terms, they say:
- On November 1, the attacker registered a customer account on OPSSHIELD's billing portal and ordered a free trial. Later that day (22:58 UTC) they were able to run commands on OPSSHIELD's billing and licensing server.
- The attacker then used stolen credentials to upload a fake cPGuard update. The disclosure puts the upload between 02:04 and 02:09 UTC on November 2, and the advisory gives 02:06 UTC as the start.
- Customer servers installed the fake update between 02:08 and 03:20 UTC, about 70 minutes, and it ran as root.
- The script gathered sensitive files and uploaded them to OPSSHIELD's own licensing server. The attacker later retrieved some of them from there.
- It also left a backdoor shell on customer servers.
- OPSSHIELD revoked the stolen key and released a clean update.
What is confirmed, and what is not
Confirmed by OPSSHIELD:
- Affected versions: cPGuard 5.88.12 through 5.88.19.
- Files the script targeted: /etc/shadow and /etc/passwd (Linux password hashes), root's MariaDB/MySQL my.cnf, root shell history, and root's SSH authorized_keys and known_hosts files.
- According to the disclosure, about 2,950 customer servers ran the fake update.
- About 7,900 billing portal accounts were exposed, including name, company, postal address, email address and a bcrypt-hashed password.
Not known, or still provisional:
- How the attacker got the credentials. The advisory says this is still under investigation.
- Exactly what was taken from each server. The advisory estimates the attacker retrieved 32 collected files, each from one customer server. It calls this a preliminary figure, not the total number of potentially affected servers. OPSSHIELD has also not confirmed that every listed file was collected from every server.
- Whether the attacker logged in by hand to any customer server. The disclosure says to rebuild from a backup taken before November 1 if that happened. The advisory says a full rebuild is not currently recommended as a routine step, and calls that guidance provisional.
The two documents name different fixed versions. The advisory requires 5.88.25 or later, and the disclosure names 5.88.26 as the clean update. Installing the newest version available satisfies both.
Which cPGuard versions are affected
| cPGuard version | What OPSSHIELD says |
|---|---|
| 5.88.12 through 5.88.19 | Affected range: the fake update |
| 5.88.25 or later | Minimum version required by the advisory |
| 5.88.26 | Clean update named in the disclosure |
A fixed version today does not mean your server was safe on November 2. The advisory says that if your update history shows any version from 5.88.12 to 5.88.19, the server installed an affected update, even if it now runs 5.88.25 or later. The disclosure goes further: any server that was online with cPGuard between 02:08 and 03:20 UTC on November 2 should be treated as having its root-level secrets exposed.
How to check your cPGuard server
OPSSHIELD's advisory gives these commands, to be run as root:
- Update:
cpgcli update --start - Confirm the version:
cpgcli --version - Check the update history:
grep 'Successfully updated' /opt/cpguard/logs/install_log
Next, look for the files OPSSHIELD lists for customer servers:
/etc/cron.d/i93677/var/tmp/.i93677//var/tmp/.cpg91511_sh(a setuid-root shell, which is the backdoor)/var/tmp/.cpg91511/and the staged archive/var/tmp/.cpg91511/loot.tgz- A script named
cpguard-v58812-i91511.sh. The disclosure lists four variants with their SHA-256 hashes, along with an attacker IP address.
The corrective update deletes these files. OPSSHIELD warns that their absence does not prove the script never ran, and that missing or incomplete log entries do not prove a server was unaffected. If the server was online during the window, assume it was exposed.
Also review /root/.ssh/authorized_keys for any entry you do not recognise. On November 3, OPSSHIELD released an update that removes its own support-access keys from servers where they had been added. The advisory says this does not replace the other steps.
What to rotate this week
| What | Why | What to do |
|---|---|---|
| Root and local Linux passwords | /etc/shadow was targeted | Reset root and every password-enabled account, from a trusted recovery environment |
| Root SSH keys | authorized_keys and known_hosts were targeted | Generate new keys under /root/.ssh and remove the old public keys from every system that trusts them |
| Keys to other servers | known_hosts lists the servers this one connects to | Replace keys for any server reachable over SSH from the affected host |
| MySQL/MariaDB passwords | Root my.cnf was targeted | Change the MySQL root password and any database password stored in /root/.my.cnf |
| Secrets in shell history | Root history was targeted | Rotate anything typed into a command: API tokens, S3 access keys, DigitalOcean tokens, and /root/.s3cfg credentials |
| OPSSHIELD billing portal login | About 7,900 accounts exposed | Reset the password and turn on two-factor login |
The billing data includes names, companies and postal addresses. Expect convincing phishing emails that use those details, and verify any message claiming to come from OPSSHIELD before acting on it.
Why this matters for a business website or hosting server
Many company websites, online stores and customer portals run on a single Linux server with a control panel. A security suite on that server runs with root access by design, because it has to scan and clean every file. Hijack its update channel and the attacker gets the same root access, with no flaw in your own setup needed.
The stolen files are a starting kit for the next step. Shell history often contains passwords typed straight into commands. The known_hosts file is effectively a list of the other servers this one talks to, and root SSH keys may open them: backups, staging sites, or other clients' servers if you are a web agency or host. That is why OPSSHIELD's list goes beyond the server itself.
If a hosting company or agency manages your server, ask them directly whether cPGuard is installed, what version it ran on November 2, and whether they have finished the rotation steps above.
cPGuard compromise questions people are asking
Was cPGuard hacked?
Yes. OPSSHIELD confirms an attacker broke into its billing and licensing server and used stolen credentials to push a fake cPGuard update to customer servers on November 2, 2026.
Which cPGuard versions are affected?
Versions 5.88.12 through 5.88.19. The advisory requires 5.88.25 or later, and the disclosure names 5.88.26 as the clean update.
I am already on 5.88.25 or 5.88.26. Am I safe?
Not necessarily. Check the install log. If it shows any version from 5.88.12 to 5.88.19, or the server was online between 02:08 and 03:20 UTC on November 2, rotate your secrets.
What did the cPGuard malware steal?
It targeted Linux password hashes, root's MySQL configuration, root shell history and root SSH key files. OPSSHIELD has not confirmed that every file was taken from every server.
Do I need to rebuild my server?
Not as a routine step, according to OPSSHIELD's current, provisional guidance. If you see signs the attacker logged in by hand, the disclosure says to rebuild from a backup taken before November 1.
I do not use cPGuard. Should I care?
Yes, as a warning. Any tool that updates itself and runs as root can be used the same way if its vendor is breached.
The bigger lesson
A security tool is still software from someone else, and its auto-update is a trusted path straight to root. For every tool on a server that runs as root, ask two questions: who can push code to it, and what secrets on that box would that code see? Keep passwords out of shell history, give each server its own SSH keys, and know how you would rotate everything in an afternoon. Then a breach at a vendor is a busy day for you, not a disaster.
Want a second set of eyes on your servers? See security hardening or get a quote.
Get security alerts like this by email, plus our free checklist, at /security-alerts.
Sources: OPSSHIELD: cPGuard update channel compromise advisory; OPSSHIELD: Security incident disclosure.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Rosstat Cyberattack: Russia's Statistics Agency Is Still Restoring Systems, What Is Confirmed and What Businesses Should Check
Rosstat says it is still restoring systems after cyberattacks from October 29 to November 1, 2026. Hackers cla...
Ransomware Business Continuity: Why Backups Alone Won't Keep Your Company Running, and What to Do This Week
Backups can bring systems back, but they do not keep work moving during the outage. Here is what Japan's IPA l...
Sshole SSH Vulnerability (CVE-2026-123158): Exploit Attempts Hit Honeypots, Which Alpine Linux Servers Are Exposed, and the Fixed Versions to Install
An OpenSSH flaw called Sshole can let attackers skip the password on some Alpine Linux servers, and honeypots...
