What happened
- OpsShield, the developer of cPGuard, issued an alert on 3 November 2026: an attacker used the product’s update channel to distribute a malicious script. BleepingComputer reported it that day.
- According to the company, the attack began on 2 November at 02:06 UTC, when someone used compromised credentials to get into OpsShield’s update distribution infrastructure (CDN).
- The affected versions run from 5.88.12 to 5.88.19. OpsShield says it detected the attack and stopped distribution in under 12 hours.
- A spokesperson told BleepingComputer that 2,946 servers were affected and that the company’s billing system database was also copied.
Why it matters
- cPGuard is a security suite for Linux web servers, with malware scanning, firewalls and attack protection. Hosting firms and server administrators use it alongside panels such as cPanel, DirectAdmin and Plesk, and Namecheap offers it on virtual and dedicated servers.
- In other words, the tool installed to protect servers was the one that exposed them.
- The script stole sensitive data from each machine and uploaded it to OpsShield’s licensing server through a compromised account, from which the attackers retrieved it.
The number
32. That is the number of files the attacker retrieved from each server, according to evidence from OpsShield’s investigation.
Context
It is unclear how the credentials that started the attack were obtained. OpsShield warned that some servers may not have received the script, because update checks happen at fixed intervals, but it could not confirm this. The company says updating to the latest version removes the backdoor and the attacker’s staged files, although stolen credentials must be invalidated as soon as possible. As an extra precaution, it will release an update that removes previously installed OpsShield support-access keys.
At Mamífero we follow flaws in server software. We reported that PHP fixed two remote execution flaws that had stalled for two years and that SGLang exposed remote code execution without a key. Also that UpGuard found 16,326 open Supabase databases and that ransomware operators exploited a GlobalProtect flaw.
What’s next
- OpsShield asks that every server running cPGuard be updated to version 5.88.25 or later.
- It also recommends changing passwords and rotating database credentials, cloud secrets and SSH keys.
- The company said it is working on blocking access, rebuilding the affected systems and preparing a public announcement.
Bottom line
The cPGuard attack repeats a familiar supply-chain pattern: whoever controls the updates controls the machines that trust them. Twelve hours were enough to reach almost 3,000 servers.
Sources
- BleepingComputer, “Hackers hijack cPGuard autoupdate to deploy backdoor, steal data”, 3 November 2026, bleepingcomputer.com. It reproduces the OpsShield alert and statements from a company spokesperson.
- Cover image: David Monniaux, CC BY-SA 3.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
