OPSSHIELD, the developer of the cPGuard Linux web-server security suite, said in a security advisory published 3 November 2026 that on 2 November at 02:06 UTC (10:06 am Perth time) an unidentified attacker used compromised credentials to gain unauthorised access to its update distribution infrastructure (CDN) and distributed a malicious script through the cPGuard update channel.

OPSSHIELD says it detected the attack within 12 hours of the affected updates, cPGuard versions 5.88.12 to 5.88.19, and that because update checks run at intervals some servers may not have run the script.

It says the script collected /etc/shadow and /etc/passwd, the root MariaDB/MySQL configuration (my.cnf), root shell history and root SSH authorisation and known-hosts files, and uploaded the data to OPSSHIELD's own licensing server under a compromised account for the attacker to retrieve; it has confirmed the attacker retrieved some of that data and, in an investigation update, estimates the attacker retrieved 32 collected files, each corresponding to a customer server, calling this a preliminary estimate of confirmed retrieval and not the total number of potentially affected servers. cPGuard 5.88.25 or later removes the known backdoor (/var/tmp/.cpg91511_sh) and the staged files.

OPSSHIELD says it secured the account, cleared its infrastructure credentials, stopped further distribution, and is releasing an update to remove its own support-access keys from cPGuard servers as a precaution; it is not recommending a routine operating-system rebuild, calling that assessment provisional. (source: OPSSHIELD)

BleepingComputer reported that an OPSSHIELD spokesperson told it the company detected 2,946 servers affected with the listed information copied, and that its billing system database was also copied. (source: BleepingComputer)