A cyberattack targeting OPSSHIELD's software distribution infrastructure allowed an unidentified attacker to compromise cPGuard updates and deploy a malicious script across customers' Linux servers, harvesting password hashes, SSH keys, database credentials, and other sensitive information.
The incident began on November 2, 2026, when the attacker exploited compromised credentials to access OPSSHIELD's update distribution infrastructure. According to the company's investigation, approximately 2,950 customer servers executed the malicious update, while nearly 7,900 billing portal account records were also exposed.
cPGuard, OPSSHIELD's Linux server security solution, provides malware scanning, firewall management, and attack protection for web hosting environments, including servers running cPanel, DirectAdmin, and Plesk.
Compromised Update Infrastructure Delivered Malicious Script
OPSSHIELD's investigation traced the intrusion to its billing and licensing application. The attacker initially registered a customer account under a false identity on November 1 and requested a free cPGuard trial to examine communications between the software and its licensing infrastructure.
After probing the billing portal and submitting specially crafted requests, the attacker obtained command execution on the company's billing and licensing server. This access enabled the theft of credentials used to distribute software updates.
Between 02:04 and 02:09 UTC on November 2, the attacker uploaded a malicious update using a stolen access key. The compromised versions, ranging from 5.88.12 through 5.88.19, were distributed for approximately 70 minutes and executed with root privileges on servers checking for updates during that period.
OPSSHIELD detected the compromise within 12 hours and subsequently revoked the stolen update key.
Password Hashes and SSH Credentials Targeted
The malicious script collected sensitive system information and transferred it to OPSSHIELD's licensing infrastructure through a compromised account, allowing the attacker to retrieve the uploaded data.
The targeted files included "/etc/shadow" and "/etc/passwd", root's MariaDB/MySQL configuration ("my.cnf"), shell history, and SSH authorization and known-hosts files. The script also accessed root's SSH private keys and cloud storage credentials on some systems.
The "/etc/shadow" file contains password hashes rather than plaintext credentials. However, attackers can attempt offline password cracking against these hashes, particularly when passwords are weak, commonly used, or previously exposed. Database configurations and shell histories may contain credentials and API tokens that are immediately usable without requiring password cracking.
OPSSHIELD initially confirmed that attackers retrieved 32 collected files, each associated with a different customer server. Its subsequent disclosure estimated approximately 2,950 servers executed the malicious update.
The attackers also copied approximately 7,900 billing portal records containing customer names, company information, postal addresses, email addresses, and bcrypt-hashed passwords.
OPSSHIELD Releases Security Updates
The malicious script left several identifiable artifacts, including "cpguard-v58812-i91511.sh", a hidden root shell at "/var/tmp/.cpg91511_sh", and a collection directory at "/var/tmp/.cpg91511", containing the staged archive "loot.tgz".
OPSSHIELD's corrective updates remove the known backdoor and associated malicious files. However, removing these artifacts does not establish that a server was never compromised.
The company initially recommended updating to version 5.88.25 or later. Its subsequent disclosure identified version 5.88.26 as the clean release, which also addresses additional persistence mechanisms.
Administrators should run "cpgcli update --start" and verify the installed version using "cpgcli --version".
For potentially affected systems, OPSSHIELD recommends resetting local account passwords, rotating database credentials, S3 access keys, DigitalOcean tokens, and other exposed secrets. Administrators must also replace root SSH private keys and remove corresponding public keys from systems that previously trusted them.
Customers should additionally reset their OPSSHIELD billing portal passwords and enable two-factor authentication.
OPSSHIELD has also begun revoking its previously deployed support-access keys and rebuilding compromised internal infrastructure. Although the company initially did not recommend routine operating system reinstalls, its updated disclosure confirms that affected customer servers are being rebuilt where necessary.