OPSSHIELD, the company behind the cPGuard server security suite, said on November 3 that an attacker used stolen credentials to get into its update servers and pushed a malicious script to customers through the normal cPGuard update channel. The push started on November 2 at 02:06 UTC. The cPGuard compromise hit versions 5.88.12 through 5.88.19, and the vendor says it stopped the distribution within 12 hours.
cPGuard runs on Linux web servers next to control panels like cPanel, DirectAdmin and Plesk. If your website sits on a VPS or dedicated server, or your host uses cPGuard on its machines, this is worth a check today.
What’s new
According to OPSSHIELD’s notice, the script collected the server’s password files, the root MySQL or MariaDB config, root shell history and root SSH key files, then uploaded them to OPSSHIELD’s own licensing server through a compromised account. The vendor says the attacker retrieved some of that data. Its preliminary count is 32 collected files, one per customer server. BleepingComputer reported that an OPSSHIELD spokesperson put the number of affected servers at 2,946 and said the billing database was also copied.
The fix is cPGuard 5.88.25 or later, which removes the backdoor and the staged files. OPSSHIELD is also releasing an update that removes its own support-access keys from customer servers.
Who it affects
Anyone who runs cPGuard on a Linux server and installed one of the affected updates. Hosting companies are the main users, and some providers offer it on VPS and dedicated plans. A business on ordinary shared hosting can’t patch this itself, but it can ask the host whether its servers ran cPGuard and what they’ve done since November 2.
Our take
If you manage your own server, update cPGuard now and confirm the version. Then check the install log for any 5.88.12 to 5.88.19 entry, because a fixed version today doesn’t prove the bad one never ran. If it did, follow the vendor’s advice: reset root and local passwords, rotate database passwords and any API keys or cloud tokens that appear in shell history, and replace the root SSH keys. This is the second hijacked vendor update we’ve covered in a week, after the DebugBear monitoring script hijack, and it’s a good reason to keep a written list of every agent and plugin with automatic access to your servers. For older flaws attackers keep reusing, see our note on the Fragnesia and PHP2Shell attacks.
Not sure what’s running on your hosting? Our IT consulting team can review your servers and access, or browse all our services.
