cPGuard update channel hijacked to push a backdoor to 2,950 servers

cPGuard update channel hijacked to push a backdoor to 2,950 servers

3 November 2026: OPSSHIELD, which makes the cPGuard security agent used on cPanel and other Linux hosting servers, says an attacker broke into its billing and licensing systems, stole an access key for its update storage and pushed a malicious update through the cPGuard update channel in the early hours of 2 November UTC. About 2,950 servers installed it. Because cPGuard runs as root, the script collected the servers' most sensitive secrets and left a backdoor behind.

Not yet independently verified. OPSSHIELD says it is still investigating how the attacker obtained the credentials and how much data was taken, and its two notices differ on the clean version (5.88.25 in the advisory, 5.88.26 in the disclosure); we give the newer one. We will update this when it can be confirmed, and remove this note.

From a free trial to the update server

OPSSHIELD's disclosure sets out the timeline in UTC:

• 1 November, 15:38: probing of the billing portal, manage.opsshield.com;
• 16:34: the attacker registered a customer account under a false identity and ordered a free trial;
• 22:58: command execution on the billing and licensing server;
• 2 November, 02:04 to 02:09: a fake update uploaded to update storage with a stolen access key;
• 02:08 to 03:20: the tampered update was live, about 70 minutes in all.

The affected builds are cPGuard 5.88.12 to 5.88.19 inclusive. Servers that were not online during that window did not receive the script.

What the script took

According to OPSSHIELD, the script read /etc/shadow and /etc/passwd, the root MySQL or MariaDB configuration in my.cnf, root's shell history, and root's SSH authorised keys and known hosts. It also left a hidden root shell and a scheduled task; the indicators include /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh, the attacker address 94.183.188.91 and script names beginning cpguard-v58812-i91511, with SHA-256 hashes on the disclosure page.

The billing break-in exposed a second set of data: about 7,900 portal accounts with names, companies, postal addresses, email addresses and bcrypt password hashes. OPSSHIELD asks every customer to reset their manage.opsshield.com password. It has revoked the stolen key, is reissuing all licence keys and is rebuilding its billing and licensing servers.

"We are sorry. You trusted cPGuard to protect your servers," the company writes.

Clean-up for hosting providers

OPSSHIELD's steps for anyone running cPGuard:

• update with cpgcli update --start and confirm 5.88.26 with cpgcli --version, which removes the attacker's tools;
• check whether an affected build was installed with grep 'Successfully updated' /opt/cpguard/logs/install_log;
• from a trusted machine, reset root and every local password, rotate MySQL credentials, S3 and cloud API tokens and any secret that appears in root's shell history, and replace /root/.ssh keys, removing the old public keys from every server they unlock.

The company does not advise rebuilding every server, calling that guidance provisional, but says servers where the attacker logged in by hand should be rebuilt from a backup taken before 1 November. For a hosting business, customer sites on those servers inherit the exposure, so the database passwords of hosted accounts deserve the same rotation as the server's own.

Company profile on TrustList: OPSSHIELD

Sources

• OPSSHIELD: cPGuard update channel compromise, security advisory, 3 November 2026
• OPSSHIELD: security incident disclosure, 3 November 2026
• iThome: cPGuard update mechanism compromised (Chinese), 4 November 2026