GoKawiilcPGuard update servers compromised, pushing backdoor to customers Nov 2
OpsShield says attackers used stolen credentials to breach its CDN and push a malicious script through cPGuard's auto-update channel between 02:06 UTC on November 2 and roughly 12 hours later, affecting versions 5.88.12 through 5.88.19. The script harvested Linux password hashes, root database configs, root shell history, and SSH keys, uploading them to OpsShield's own licensing server, where the attacker pulled an average of 32 files per compromised customer.