Breach · 6 min read
A hijacked cPGuard update stole root secrets from about 2,950 web hosting servers
An attacker posed as a customer, broke into OPSSHIELD’s billing server and pushed a fake security update. Here’s what it took, who is affected and what server owners and their customers should do.
cPGuard is a security suite for Linux web servers: malware scanning, a firewall and attack protection, often run by hosting companies next to control panels like cPanel, DirectAdmin and Plesk. BleepingComputer notes that Namecheap offers it on its VPS and dedicated servers. On November 2, the tool meant to protect those servers was turned against them. An attacker pushed a fake cPGuard update that ran as root and sent the server’s most sensitive files away. OPSSHIELD, the small company behind cPGuard, published a full disclosure on November 3. This is how it happened and what to do about it.
What happened
OPSSHIELD says the attacker signed up as a customer, used that account to break into its billing and licensing server, took the keys it uses to publish updates and shipped a fake cPGuard update for about 70 minutes. Its timeline, in UTC:
| When (UTC) | What happened |
|---|---|
| Nov 1, 15:38 | The attacker starts probing OPSSHIELD’s billing portal, manage.opsshield.com |
| Nov 1, 16:34 | The attacker registers a customer account under a false identity and orders a free cPGuard trial |
| Nov 1, 21:17 | The attacker installs the trial on their own server to study how it talks to the licensing system |
| Nov 1, 22:58 | The attacker gains the ability to run commands on the billing and licensing server and starts collecting data |
| Nov 2, 02:04 to 02:09 | The attacker uploads a fake update to OPSSHIELD’s update storage, using a stolen access key |
| Nov 2, 02:08 to 03:20 | cPGuard agents install the fake update, which runs as root and copies sensitive files back to the attacker |
| Nov 2 | The stolen key is revoked and clean version 5.88.26 is published |
| Nov 3 | The entry point is traced and the disclosure is published |
OPSSHIELD says its logs don’t record the exact request that gave the attacker access, so it is reviewing the billing application’s code and has patched two possible entry points it found. It has ruled out SSH, the control panel, FTP and API tokens. Its earlier advisory lists cPGuard versions 5.88.12 through 5.88.19 as the affected updates.
What was taken
The fake update was a short script, not a long-term implant. On the servers that ran it, OPSSHIELD says it read:
/etc/shadowand/etc/passwd, the server’s local password hashes/root/.ssh, including root’s private SSH keys and the list of keys allowed to log in/root/.my.cnf, which often holds the MySQL root password- root’s shell history, which often contains passwords and tokens typed at the command line
/root/.s3cfgcloud storage keys, on a small number of servers
It also left two things behind: a hidden root shell at /var/tmp/.cpg91511_sh and files in /var/tmp/.i93677/, plus a scheduled task at /etc/cron.d/i93677.
| Who | Count | What was exposed |
|---|---|---|
| Customer servers that ran the fake update | about 2,950 | Password hashes, root SSH keys, MySQL root password, shell history |
| Billing portal accounts | about 7,900 | Name, company, postal address, email and a bcrypt password hash |
A spokesperson told BleepingComputer the exact count was 2,946 servers, and that the billing system database was copied too. OPSSHIELD says the attacker also made copies of three of its own cloud servers.
Why it matters, even if you’ve never heard of cPGuard
Most people who are affected won’t know it. If your website, online shop or email is hosted by a small or mid-sized host, there’s a chance one of its servers ran cPGuard. Root access to a shared hosting server can mean access to every site, database and mailbox on it. OPSSHIELD hasn’t said the attacker used the stolen secrets to get into customer sites, and nothing public so far shows that. But the secrets were taken, so hosts need to replace them before anyone can try.
This is also the same pattern we’ve seen in other recent supply chain attacks: the attacker doesn’t break into thousands of servers one at a time, they break into the one place those servers trust for updates. In its disclosure, OPSSHIELD says attacks like this are getting faster and cheaper to run because attackers use AI tools to scan for weak points and write custom tools, and that about ten hours from first probe to fake update “reflects that.” That is the company’s view of the trend, not a finding about who was behind this attack.
If you run a server with cPGuard
OPSSHIELD says these steps take most admins under an hour per server:
- Check whether you got a bad update. Run
grep 'Successfully updated' /opt/cpguard/logs/install_logand look for versions 5.88.12 to 5.88.19. OPSSHIELD’s disclosure says servers where cPGuard was offline between 02:08 and 03:20 UTC on November 2 didn’t receive it, but the install log is the surest check. - Update cPGuard to the latest version (at least 5.88.26), then make sure
/etc/cron.d/i93677,/var/tmp/.i93677/and/var/tmp/.cpg91511_share gone. Delete them if they aren’t. - Change the root password and every local user password.
- Generate new root SSH keys, remove the old ones from
authorized_keyson every server that trusted them and look for keys you don’t recognize. Treat other servers this one could reach over SSH as exposed until their keys are replaced. - Change the MySQL root password and any database passwords in
/root/.my.cnf, and rotate any password, API key or token in root’s shell history or/root/.s3cfg. - Reset your manage.opsshield.com password and turn on two-factor login, even if your servers didn’t get the update.
- If OPSSHIELD told you the attacker logged in to your server by hand, rebuild it from a clean backup taken before November 1.
OPSSHIELD says it will help at no charge through its support tickets, and its disclosure lists indicators of compromise for security teams.
If your website or email is hosted somewhere
You probably can’t tell whether your host uses cPGuard, and you don’t need to panic. A few low-effort steps help either way:
- Watch for a notice from your host and follow it. If your host mentions cPGuard or a password reset, do it promptly.
- Change your hosting control panel, FTP and database passwords if your host asks you to, and use a different password for each.
- Turn on two-factor login for your hosting account.
- Keep an eye on your site for pages, users or redirects you didn’t create.
How Frame helps
This incident mostly exposed server secrets rather than personal data, but if your email was in OPSSHIELD’s billing portal you can add this breach to a verified email in Frame. Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each vendor its own address, so a leak at one doesn’t reach everything. Frame never collects or stores the leaked records themselves.
Related coverage
- OVHcloud CLI downloads were swapped for a secret-stealer: another case where a trusted download channel delivered malicious code.
- A malicious LiteLLM release stole credentials for about two hours: how a poisoned package release reached developers who trusted it.
Sources
- OPSSHIELD, Security Incident Disclosure: manage.opsshield.com, November 3, 2026
- OPSSHIELD, cPGuard security advisory: Update channel compromise, November 2026
- BleepingComputer, Hackers hijack cPGuard autoupdate to deploy backdoor, steal data, November 3, 2026
- Help Net Security, Poisoned cPGuard update hits thousands of web hosting servers, November 4, 2026
- The Hacker News, cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes, November 2026
- SecurityWeek, Malicious cPGuard Updates Served in OpsShield Supply Chain Attack, November 4, 2026
More stories
- BreachArara breach: Asoview says 15.8 million member records leaked, and more companies name their counts · 6 min read
- BreachCrime Stoppers breach: federal and B.C. privacy commissioners open investigations · 5 min read
- BreachHarvard’s alumni and donor breach is now in Have I Been Pwned: 851,000 email addresses · 4 min read
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.