{"id":"CMP-202611-nvoxcm","kind":"campaign","aliases":[],"related":[],"title":"cPGuard server security software update channel hijacked: attackers pushed a backdoor that steals root password hashes, SSH keys and cloud tokens (OPSSHIELD confirms)","description":null,"summary":"OPSSHIELD, maker of the cPGuard security plugin for cPanel, DirectAdmin and other hosting control panels, told customers on 2 Nov 2026 that an unidentified attacker got into its licensing and update systems and pushed a malicious script to customer servers through the normal cPGuard update channel. The script runs as root. It plants a backdoor shell, collects /etc/shadow password hashes and other credentials into an archive (loot.tgz), and sends the data to an endpoint on OPSSHIELD's own licensing server through a compromised account. Affected releases are reported as 5.88.12 to 5.88.19. One customer's logs show the update to 5.88.12 followed in the same second by reads of /root/.ssh/authorized_keys and private keys. Distribution has stopped and 5.88.25 removes the known backdoor. The start date, the number of servers that ran the script and how the attacker got in are all unknown. The vendor notice has been reposted by customers on r/netsec, the DirectAdmin forum and Portal do Host.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-02T23:46:44+00:00","products":[{"name":"cPGuard","fixed":["5.88.25"],"vendor":"OPSSHIELD","versions":">=5.88.12 <=5.88.19"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Run cpgcli --version on every server that has cPGuard. Versions 5.88.12 to 5.88.19 are affected. Look for /var/tmp/.cpg91511_sh (the backdoor shell) and the /var/tmp/.cpg91511 directory, including loot.tgz. In cPGuard logs, look for 'software_update.php start as root' / 'Successfully updated to 5.88.12' followed by access to /root/.ssh. Check for unknown keys in /root/.ssh/authorized_keys. The attacker's IPs and domains are unknown (the stolen data went to OPSSHIELD's licensing server).","fix":"Run cpgcli update --start on every cPGuard server and confirm that cpgcli --version shows 5.88.25. If the update fails, contact OPSSHIELD support. If the script may have run, treat the server as compromised. From a trusted recovery environment, reset passwords for root and all local accounts. Rotate database passwords, S3 access keys, DigitalOcean tokens and any secrets in root's shell history. Replace SSH keys under /root/.ssh and remove their old public keys from every system that trusts them. Do this even if the update succeeds.","status":"open","published_at":null,"first_seen_at":"2026-11-02T23:46:44+00:00","triaged_at":"2026-11-02T23:46:44+00:00","updated_at":"2026-11-02T23:46:44+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':25A '/etc/shadow':93B '/root/.ssh/authorized_keys':145B '2':54B '2026':56B '5.88.12':125B,136B '5.88.19':127B '5.88.25':153B 'account':119B 'affect':120B 'archiv':101B 'attack':8A,60B,172B 'backdoor':11A,90B,157B 'breach':28A,30A 'campaign':32B 'channel':6A,81B 'cloud':20A 'cmp':24A 'collect':92B 'compromis':118B 'confirm':23A 'control':49B 'cpanel':44B 'cpguard':1A,27A,31A,40B,79B 'credenti':98B 'custom':52B,74B,129B,185B 'data':106B 'date':160B 'directadmin':45B,189B 'distribut':149B 'earli':34B 'early-warn':33B 'endpoint':109B 'follow':137B 'forum':190B 'got':61B,173B 'hash':16A,95B 'hijack':7A 'host':48B,194B 'key':18A,148B 'known':156B 'licens':64B,114B 'log':131B 'loot.tgz':102B 'maker':37B 'malici':71B 'normal':78B 'notic':180B 'nov':55B 'number':162B 'nvoxcm':26A 'one':128B 'opsshield':22A,29A,36B,111B 'panel':50B 'password':15A,94B 'plant':88B 'plugin':42B 'portal':192B 'privat':147B 'push':9A,69B 'r/netsec':187B 'ran':166B 'read':143B 'releas':121B 'remov':154B 'report':123B 'repost':183B 'root':14A,86B 'run':84B 'script':72B,83B,168B 'second':141B 'secur':3A,41B 'send':104B 'server':2A,75B,115B,164B 'shell':91B 'show':132B 'softwar':4A 'ssh':17A 'start':159B 'steal':13A 'stop':151B 'system':67B 'token':21A 'told':51B 'unidentifi':59B 'unknown':177B 'updat':5A,66B,80B,134B 'vendor':179B 'warn':35B","nicknames":["cPGuard breach","OPSSHIELD breach"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["cpguard","cpguardbreach","opsshieldbreach"],"ptokens":["cpguard"],"labels":["campaign","critical","earlywarning","vendor"],"first_public_at":"2026-11-02T20:14:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-nvoxcm","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-02T23:46:44+00:00","fetched_at":"2026-11-02T23:46:44+00:00","note":null}],"documents":[{"id":54479,"url":"https://www.reddit.com/r/netsec/comments/1xmcr4e/cpguard_opsshield_llp_breach/","title":"r/netsec: CPGuard / OPSSHIELD LLP Breach","kind":"post","source":"reddit","publisher":null,"text":"CPGuard / OPSSHIELD LLP Breach\n\nHad a subscription in the past with them and received the following e-mail: Doesn't look like many sites have have picked up on this: Dear cPGuard customers and partners, An unidentified attacker targeted OPSSHIELD, gained unauthorized access to our licensing and update systems, and distributed a malicious script through the cPGuard update channel. **We have stopped further distribution of the script and released cPGuard 5.88.25 to remove the known backdoor and files left by the script.** The script sent data to an endpoint on our licensing server under a compromised account. We secured that account as soon as we identified the breach and cleared our infrastructure credentials. We are investigating how the attacker gained access, which customer servers ran the script, and what data the attacker accessed. **Please take the following actions immediately.** **Update every cPGuard server.** Run `cpgcli update --start`. The corrective update removes the backdoor shell at `/var/tmp/.cpg91511_sh` and the collection directory `/var/tmp/.cpg91511`, including the password hashes and credential archive (`loot.tgz`) staged there. **Verify the installed version.** After the update completes, run `cpgcli --version` on each server and confirm it reports **5.88.25**. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately. **If you know or suspect the malicious script ran, reset passwords and revoke exposed credentials.** The script targeted `/etc/shadow`. Reset passwords for root and all other password-enabled local accounts from a trusted recovery environment. From a trusted device, change any passwords reused elsewhere and rotate affected database passwords, S3 access keys, DigitalOcean tokens, and secrets recorded in root's shell history. Replace SSH private keys stored under `/root/.ssh` and remove the corresponding old public keys from every system that trusts them. Complete this step even if the update succeeds, because credentials copied before cleanup may still be usable. We are sorry that this breach put your systems at risk. If you need help assessing a server, please contact OPSSHIELD Support through your usual support channel. We will share further findings as we verify them. The OPSSHIELD Team submitted by /u/3verse16 [link] [comments]","published_at":"2026-11-02T23:15:36+00:00","relation":"describes","confidence":null,"note":null},{"id":54508,"url":"https://forum.directadmin.com/threads/cpguard-got-hacked.82860/","title":"CPguard got hacked.. (OPSSHIELD customer notice reposted, DirectAdmin Forums)","kind":"blog","source":"analyst","publisher":null,"text":"OPSSHIELD notice: unidentified attacker gained access to cPGuard licensing and update systems and distributed a malicious script through the cPGuard update channel. Fixed release cPGuard 5.88.25 removes backdoor shell /var/tmp/.cpg91511_sh and collection dir /var/tmp/.cpg91511 (password hashes, credential archive loot.tgz). Script sent data to an endpoint on OPSSHIELD licensing server under a compromised account. Affected versions reported between 5.88.12 and 5.88.19. Script targeted /etc/shadow; rotate root/local passwords, DB passwords, S3 keys, DigitalOcean tokens, secrets in root shell history, SSH keys under /root/.ssh. Update: cpgcli update --start; verify: cpgcli --version = 5.88.25. Forum user log: 'cPGuard software_update.php start as root / Successfully updated to 5.88.12' followed by access to /root/.ssh/authorized_keys and id_dsa at the same second.","published_at":"2026-11-02T20:14:28+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}