Hackers Hijack cPGuard Autoupdate to Deploy Backdoors
Attackers compromised the update infrastructure of the cPGuard web security suite, deploying a backdoor and a data-stealing script to thousands of servers before the vendor halted the malicious campaign.
Radwan AbdulhadiEditor and technology writer
Update Infrastructure Compromise
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script, according to recent security disclosures. OpsShield, the developer behind cPGuard, published an alert stating that the attack began on November 2, 2026, at 02:06 UTC, impacting versions 5.88.12 through 5.88.19 of the software.
According to the official advisory detailed by [OpsShield said](http://opsshield.com/notice/cpguard-update-channel-compromise.html), an unidentified attacker leveraged compromised credentials to gain unauthorized access to the company's update distribution infrastructure and content delivery network (CDN). The attacker utilized this access to push a malicious script directly through the cPGuard update channel.
Scope of the Attack and Impact
cPGuard is widely utilized as a Linux web-server security suite providing malware scanning, firewalls, and attack protection. It is frequently deployed by hosting providers and server administrators working alongside standard management panels such as cPanel, DirectAdmin, and Plesk. For instance, [Namecheap offers it](https://www.namecheap.com/support/knowledgebase/article.aspx/10770/12/what-is-cpguard/) on virtual private servers and dedicated infrastructure.
The vendor reported that it successfully detected the compromise and halted the malicious distribution within 12 hours after the unauthorized versions were pushed. Although precise server responses varied due to staggered update check intervals, a spokesperson confirmed to [Bill Toulas](https://www.bleepingcomputer.com/author/bill-toulas/) that nearly three thousand servers were ultimately impacted by the breach.
A company representative stated that telemetry showed 2,946 servers were affected and copied the relevant information, alongside the billing system database. The vendor has been actively working on blocking all unauthorized access, rebuilding the impacted systems, and coordinating a public announcement.
Data Exfiltration and Investigation Findings
During the compromise window, system administrators updating their cPGuard installations inadvertently processed a script targeted at gathering sensitive machine data. The stolen files were subsequently uploaded back to OpsShield's own licensing server via a compromised account, which the threat actors then used to retrieve the stolen information.
While OpsShield has not completely established every specific data point collected from each isolated server, investigative evidence indicates that the threat actor successfully retrieved 32 distinct files from each customer machine. The unauthorized access also exposed the company's billing system database, raising further security concerns for organizations using the platform.
Remediation and Response Instructions
System administrators operating affected environments are strongly advised to take immediate remediation steps. Teams must update every cPGuard server to version 5.88.25 or later, which completely removes the deployed backdoor and any remaining staged files from the system.
In addition to updating the software package, security teams must reset passwords, rotate database credentials, update cloud secrets, and cycle all SSH keys that may have resided on potentially compromised servers. As an extra precaution, the vendor is also releasing an update designed to explicitly remove previously installed OpsShield support-access keys from managed servers.
Sources
- BleepingComputerHackers hijack cPGuard autoupdate to deploy backdoor, steal data
Continue chronologically
Related stories
Rank Math PRO Plugin Compromised in Supply-Chain Attack
The Rank Math PRO WordPress SEO plugin was compromised in a supply-chain attack, distributing malicious downloads that planted hidden backdoors.
Malicious Claude Code Extension on Cursor Plants Backdoors
A compromised version of Anthropic's Claude Code extension on Cursor exposed developers to malware designed to install persistent SSH backdoors.
Hackers Exploit Cisco SD-WAN Flaw to Deploy KeyDrift Malware
A newly identified advanced persistent threat group has been observed exploiting a Cisco SD-WAN flaw to deploy a custom malware framework called KeyDrift.
Germany Arrests Alleged Core Qilin Ransomware Member
Germany has arrested a Russian national suspected of being a leading member of the Qilin ransomware group following an extradition from Japan.
