Short answer
OPSSHIELD says an attacker used compromised credentials on 2 November 2026 to push a malicious script through the cPGuard update channel. Versions 5.88.12 to 5.88.19 installed a backdoor and collected sensitive files. The vendor detected it within 12 hours and has issued fixed versions.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | OPSSHIELD (cPGuard) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Confirmed by the organization |
| Sector | Web hosting security software |
| Country | Not stated by the vendor |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-02 |
| People or records affected | About 2,950 customer servers ran the script, and billing records for about 7,900 accounts were taken, per the vendor's later disclosure as reported by The Hacker News |
What data was exposed
- Password hashes and account files from affected Linux servers (/etc/shadow and /etc/passwd)
- Root SSH files, MySQL or MariaDB root configuration and shell history, and on a few servers S3 keys
- Billing records for about 7,900 customer accounts: names, company names, postal and email addresses, bcrypt-hashed passwords (per The Hacker News)
What happened
OPSSHIELD, the company behind the cPGuard security tool for Linux web hosting servers, published an advisory on 3 November 2026. It says an attacker used compromised credentials to reach its update distribution network at 02:06 UTC on 2 November and pushed a malicious script through the normal cPGuard update channel. Affected versions are 5.88.12 through 5.88.19.
OPSSHIELD says it detected the attack within 12 hours of the bad updates launching. The attacker has not been identified.
What the script did
The script installed a backdoor and collected sensitive files for the attacker. The advisory lists /etc/shadow and /etc/passwd, root MySQL or MariaDB configuration, root shell history and root SSH files. It cautions that it has not confirmed every file was taken from every server, and that long unique passwords make the stolen hashes harder to use.
The Hacker News, summarizing the vendor’s later disclosure, reports about 2,950 servers installed the script between 02:08 and 03:20 UTC. It also reports the attacker copied three OPSSHIELD cloud servers and took billing records for about 7,900 customer accounts, including names, company names, postal and email addresses, and bcrypt-hashed passwords. We could not open the later disclosure directly, so those figures rest on that report.
How the attacker got in
The first advisory says the entry point was still under investigation. The Hacker News reports that the later disclosure describes a fake customer account registered on 1 November, crafted requests to billing portal callback pages and command execution on the billing and licensing server, from which the update publishing key was taken. OPSSHIELD’s logs do not record the exact request, and two possible entry points have been patched.
Fixes and clean-up
Version 5.88.25 or later removes the known backdoor and staged files, and OPSSHIELD began releasing a further update on 3 November to remove its support-access SSH keys from servers where they were added. The company has reset billing sessions, rotated keys and is rebuilding internal servers from clean images, according to The Hacker News. Indicators include the script cpguard-v58812-i91511.sh, the file /var/tmp/.cpg91511_sh and the directory /var/tmp/.cpg91511.
What hosting customers should do
Any host that ran an affected version should treat root credentials as exposed. See our data breach checklist for the general steps. This sits alongside other tooling compromises, such as the LiteLLM PyPI release compromise. Fake vendor emails about the incident are a risk, so review the phishing messages guide.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails posing as OPSSHIELD or cPGuard support that ask for billing portal logins or root access.
- Attacks on hosted websites using stolen root credentials, such as defacement, fake login pages or card skimmers.
- Targeted emails to hosting customers that use their company name and address from the billing records.
What to do if you are affected
- 01Update every cPGuard server with cpgcli update --start and confirm version 5.88.25 or later with cpgcli --version.
- 02Check /opt/cpguard/logs/install_log for 'Successfully updated' entries covering versions 5.88.12 to 5.88.19. A missing log does not prove a clean server.
- 03On any server that may have run the script, reset root and local passwords from a trusted environment and replace root SSH keys.
- 04Rotate database, S3 and cloud provider credentials, and any secrets in root's shell history.
- 05Reset your OPSSHIELD billing portal password, turn on two-factor login, and look for the listed indicator files.
Frequently asked questions
Which cPGuard versions are affected?
OPSSHIELD says versions 5.88.12 through 5.88.19 inclusive. The fix is version 5.88.25 or later, which removes the backdoor and staged files but cannot undo credentials already copied.
What did the malicious script take?
OPSSHIELD lists /etc/shadow and /etc/passwd, root MySQL or MariaDB configuration, root shell history and root SSH files. It has not confirmed that every file was collected from every server.
How many servers ran the script?
The Hacker News reports that OPSSHIELD's later disclosure puts it at about 2,950 customer servers. The first advisory gave a preliminary figure of 32 retrieved files, each tied to one customer server.
How did the attacker get in?
OPSSHIELD's first advisory says compromised credentials reached its update CDN at 02:06 UTC on 2 November. The Hacker News reports the later disclosure describes entry through the billing portal, with two possible entry points patched. The company says the exact request was not logged.
Do I need to rebuild my server?
OPSSHIELD does not recommend a routine rebuild. If an attacker logged in manually to a server, the later disclosure says it should be rebuilt from a clean backup taken before 1 November.
Sources
- cPGuard security advisory: Update channel compromise, OPSSHIELD, 2026-11-03
- cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes, The Hacker News, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.