cPGuard server security software update channel hijacked: attackers pushed a backdoor that steals root password hashes, SSH keys and cloud tokens (OPSSHIELD confirms)

OPSSHIELD, maker of the cPGuard security plugin for cPanel, DirectAdmin and other hosting control panels, told customers on 2 Nov 2026 that an unidentified attacker got into its licensing and update systems and pushed a malicious script to customer servers through the normal cPGuard update channel. The script runs as root. It plants a backdoor shell, collects /etc/shadow password hashes and other credentials into an archive (loot.tgz), and sends the data to an endpoint on OPSSHIELD's own licensing server through a compromised account. Affected releases are reported as 5.88.12 to 5.88.19. One customer's logs show the update to 5.88.12 followed in the same second by reads of /root/.ssh/authorized_keys and private keys. Distribution has stopped and 5.88.25 removes the known backdoor. The start date, the number of servers that ran the script and how the attacker got in are all unknown. The vendor notice has been reposted by customers on r/netsec, the DirectAdmin forum and Portal do Host.

Summary written from the sources below. Check the originals before acting.