Attackers hijacked cPGuard updates to plant a backdoor and collect server secrets, with 32 files confirmed retrieved from OPSSHIELD's server.

cPGuard gehackt: Rund 2.950 Linux-Server erhielten manipulierte Updates. Welche Versionen betroffen sind und wie Du Backdoors entfernst.

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...]

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.

OpsShield says attackers used compromised credentials to distribute malicious cPGuard updates. The company estimates 2,950 servers ran them and about 7,900…

Unschöne Sache für Leute, die die Sicherheits- und Anti-Malware-Suite für Linux-Webserver, cPGuard von Opsshield verwenden. Die Nacht ist mir die Information untergekommen, dass die Suite von Hackern…

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.

OPSShield says attackers copied 7,900 billing records and ran a malicious cPGuard update as root on about 2,950 customer servers.

A compromised distribution system let threat actors deliver a fake cPGuard update to thousands of Linux servers, where it ran with root privileges.

have executed the script read more about cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes

インドのITセキュリティ企業OpsShieldは月曜日、サイバー攻撃を受けました。この攻撃により、同社の顧客に悪意あるバージョンのcPGuardが配信されました。 OpsShieldはサーバー保護やWebセキュリティのソフトウェアを手がけており、cPGuardはその代表的な製品です。Linux型のWebホスティングサ

攻撃者がWebセキュリティスイート「cPGuard」の更新インフラを侵害し、バックドアとデータ窃取スクリプトを配布しました。 cPGuardの開発元であるOpsShieldは本日早く、注意喚起を公開しました。それによると、攻撃は11月2日の02:06 UTCに始まり、バージョン5.88.12から5.88.19までが影

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script. [...]

Attackers hijacked the update channel for cPGuard, a security add-on for Linux hosting servers, and on November 2, 2026 pushed a fake update that copied root password hashes, SSH keys and database logins. According to OpsShield's incident disclosure, about 2,950 customer servers ran it. cPGuard is sold for servers run with cPanel, DirectAdmin, Plesk and several other control panels, so the people affected range from hosting companies to agencies running their own VPS.