cPGuard security suite suffers update channel hijack

An unidentified attacker compromised the update distribution infrastructure of cPGuard, a Linux security suite developed by OpsShield, on November 2, 2026. By using legitimate but compromised credentials, the attacker distributed a malicious script through the company’s content delivery network (CDN).

The affected versions range from 5.88.12 to 5.88.19. The malicious script was designed to install a backdoor and steal sensitive data, including root configurations for MariaDB/MySQL databases, as well as SSH authorization and known_hosts files. Evidence suggests the attacker recovered approximately 32 files per client.

OpsShield detected the breach and halted the distribution of the malicious versions within 12 hours. While version 5.88.25 and later remove the backdoor, security experts warn that any server that executed the compromised updates must be treated as potentially compromised. Administrators are advised to change all passwords and SSH keys, as stolen credentials may remain functional even after the software is patched.