GoKawiilcPGuard update servers compromised, pushing backdoor to customers Nov 2
OpsShield says attackers used stolen credentials to breach its CDN and push a malicious script through cPGuard's auto-update channel between 02:06 UTC on November 2 and roughly 12 hours later, affecting versions 5.88.12 through 5.88.19. The script harvested Linux password hashes, root database configs, root shell history, and SSH keys, uploading them to OpsShield's own licensing server, where the attacker pulled an average of 32 files per compromised customer.
GoKawiil's interpretation of the reporting above, not reported fact.
The breach shows how a trusted software update pipeline, used widely by hosting providers and server admins including through Namecheap's VPS offerings, can become a single point of failure for mass credential theft across many servers at once. Because OpsShield can't confirm exactly which servers executed the malicious update or what data was taken from each, affected administrators may need to assume compromise and rotate credentials broadly until investigations clarify the scope.
- Attack ran from Nov 2, 02:06 UTC for about 12 hours before OpsShield detected and stopped it
- Malicious script stole password hashes, database configs, shell history and SSH keys from root accounts
- Admins are urged to update all cPGuard installations to version 5 immediately
Source: bleepingcomputer.com, 2026-11-03
Published there as: “Hackers hijack cPGuard autoupdate to deploy backdoor, steal data”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.