Overview
- OPSSHIELD reported that on Monday, November 2 the attacker used compromised credentials to upload fake cPGuard updates (v5.88.12–5.88.19) to its update storage and that those builds ran as root on about 2,950 customer servers over roughly 70 minutes.
- The malicious script installed a hidden root shell and collected high-value files such as /etc/shadow (password hashes), root SSH keys, database credentials and root shell history, then placed collected files on a licensing server for later retrieval.
- OPSSHIELD says the attacker also accessed its billing and licensing system, copied about 7,900 customer billing records including names, addresses, emails and bcrypt-hashed passwords, and retrieved 32 customer files from the licensing server.
- In response, OPSSHIELD revoked the compromised update key and other access tokens, rotated keys, rebuilt affected internal servers, and released fixed cPGuard updates (v5.88.25/5.88.26) that remove the backdoor and scheduled task.
- Customers are urged to update cPGuard now, reset passwords and SSH keys from a trusted recovery environment, rotate database and cloud secrets, and rebuild servers when OPSSHIELD confirms manual attacker access while the company continues its forensic investigation.