Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script to customer servers. OpsShield, the developer of cPGuard, published an alert stating that the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19. According to the vendor, it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised versions. "On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield's update distribution infrastructure (CDN)," OpsShield said. "The attacker used this access to distribute a malicious script through the cPGuard update channel." The attacker leveraged legitimate credentials to gain initial access, though it remains unclear how those credentials were obtained. OpsShield also noted that, because update checks occur at specific intervals, some servers may not have received or run the malicious script, although the company could not confirm this. cPGuard is a Linux web-server security suite offering malware scanning, firewalls, and attack protection. It is commonly used by hosting firms and server administrators alongside control panels such as cPanel, DirectAdmin, and Plesk, and Namecheap offers it on VPS and dedicated servers. Users who updated cPGuard during the compromise window received a script that targeted sensitive data on their machines. The stolen data was uploaded to OpsShield's licensing server through a compromised account, which the attackers then used to retrieve it. While OpsShield has not established exactly what data was collected from each server, evidence from the investigation shows the threat actor retrieved 32 files from each customer. System administrators are advised to update every cPGuard server to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys. OpsShield notes that updating to the latest version removes the backdoor and staged files, but stolen credentials must be invalidated as soon as possible. As an extra precaution, the vendor said it would release an update to remove previously installed OpsShield support-access keys. BleepingComputer contacted OpsShield for further details, and a spokesperson said the incident has impacted nearly three thousand servers. "We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time," the representative said. The company reiterated its advice for customers to update cPGuard to version 5.88.25 or later and to reset or rotate credentials that may have been exposed on potentially compromised servers.