cPGuard update channel hijacked to backdoor Linux servers and steal password hashes
Any server that installed cPGuard 5.88.12 to 5.88.19 may hold stolen credentials that still work after the fix, so passwords and keys need rotating.
OpsShield, the maker of the cPGuard Linux security suite, says an unidentified attacker used compromised credentials on November 2, 2026 to push a malicious script through its update channel, affecting versions 5.88.12 through 5.88.19. The script installed a backdoor and gathered password hashes, root database configuration, shell history and root SSH files, uploading them to a licensing server run by OpsShield, from which the attacker retrieved 32 files. The company says it detected the intrusion within 12 hours and has removed the backdoor in version 5.88.25 and later. Admins are advised to update, confirm the version, and treat any server that may have run the script as potentially compromised. Because credentials the script copied may still work after an update, affected servers need new passwords, database credentials, cloud secrets and SSH keys. OpsShield has also said that a later figure from a spokesperson put the number of affected servers at 2,946, though it has not published that count in its advisory.
Why it matters
Administrators who trusted a security vendor's update channel now have to assume their own machines were compromised by that trusted path. Updating removes the backdoor, but it does not undo the theft of password hashes, database settings, shell history and SSH files, so the credentials on affected servers have to be replaced. The gap between the 12-hour detection window and the 2,946-server figure that OpsShield has not published in its advisory means the full scope is still unclear.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.