OpsShield Confirms cPGuard Update Hijack Affecting 3,000 Servers

OpsShield, the developer of the cPGuard web security suite, has confirmed that attackers hijacked its update infrastructure to distribute a backdoor and a data-stealing script. The compromise has affected approximately 2,946 servers, with the company also reporting that its internal billing system database was exfiltrated during the incident.

The attack began on 2 November 2026 at 02:06 UTC. OpsShield stated that it detected the compromise and halted the malicious distribution within 12 hours of the attacker pushing the tainted versions.

Supply Chain Compromise via CDN

The threat actor gained initial access to OpsShield’s Content Delivery Network (CDN) using compromised credentials, though the exact method of how these credentials were obtained remains unclear. Using this access, the attacker distributed malicious versions of cPGuard through the legitimate update channel.

The compromise specifically impacted cPGuard versions 5.88.12 through 5.88.19. Because update checks occur at specific intervals, some servers may not have received or executed the malicious script during the window of compromise.

Targeted Data Exfiltration

The malicious payload consisted of a script designed to target sensitive information on Linux-based systems. Investigation evidence shows that the threat actor retrieved an average of 32 files from each affected customer server. The targeted data included:

• Linux password hashes
• MariaDB and MySQL database configurations
• Root shell history
• Root SSH authorisation and known-hosts files

The attackers used a compromised account to upload this stolen data to the OpsShield licensing server, which they then accessed to retrieve the information.

Mitigation and Remediation

System administrators are advised to immediately update all cPGuard installations to version 5.88.25 or later. While updating to the latest version removes the backdoor and any staged malicious files, the company warns that all potentially exposed credentials must be invalidated.

OpsShield recommends that users take the following immediate actions:

• Reset all system passwords
• Rotate database credentials
• Update cloud secrets
• Rotate and invalidate SSH keys

As an additional precaution, the vendor has announced it will release a further update to remove previously installed OpsShield support-access keys.