Poisoned cPGuard update hits nearly 3,000 web hosting servers: what to do
Attackers hijacked the update system of cPGuard, a security suite for Linux hosting servers, and pushed a malicious update to about 2,950 servers as root. Here's who is affected and what to do.
If you run a Linux web hosting server with the cPGuard security suite, check it today. The company behind it, OPSShield, says an attacker took over its update system and pushed a malicious “update” to nearly 3,000 customer servers. Here is what happened and what to do.
What happened?
cPGuard is a security suite for Linux web hosting servers. According to OPSShield, the attacker uploaded fake updates, versions 5.88.12 through 5.88.19, to the company’s update storage on November 2, 2026, between 02:04 and 02:09 UTC. For more than 70 minutes, cPGuard agents installed the fake update on about 2,950 customer servers and ran it as root, the most powerful account on a Linux server.
cPGuard checks for updates at intervals, so not every customer got the fake update. OPSShield says that if cPGuard was not online during that window, your server did not receive it.
What did the fake update steal?
The fake update was a short script that collected sensitive files and sent them to a server controlled by the attacker. The stolen data includes:
- Password hashes
- Root SSH keys
- The MySQL root password, where present
- Root shell history, which may contain typed passwords and tokens
- Cloud storage keys
The script also left behind a hidden root shell at /var/tmp/.cpg91511_sh and files in /var/tmp/.i93677/.
How did the attacker get in?
The day before, the attacker probed OPSShield’s billing portal, registered a customer account under a false identity, ordered a free trial and installed cPGuard to study how it talks to the licensing system. Soon after, crafted requests to the billing portal’s callback pages gave them the ability to run commands on the billing and licensing server. There they collected records for about 7,900 customers: name, company, postal address, email and a hashed password. They also copied three of the company’s cloud servers.
OPSShield says it does not yet know how the attacker got the key that allowed uploading to the update storage, or exactly how they got command access. It noted that attacks like this are getting faster, with the whole chain taking about ten hours from first probe to fake update, and said attackers now use AI tools to find weak points and write custom tools quickly.
What has OPSShield done?
- Cut off the attacker’s access to the systems it knows were reached.
- Revoked the stolen update-storage key and rotated cloud and billing keys.
- Released a clean update, version 5.88.26, which removes the hidden root shell, and a follow-up update that removes the scheduled task.
- Started re-issuing all cPGuard license key pairs and rebuilding its billing, licensing and management servers.
What should customers do?
- Check whether a malicious version was installed (5.88.12 to 5.88.19).
- Update to 5.88.26 or later, and confirm the hidden root shell and scheduled task are gone. Look for other signs of tampering, such as unfamiliar users, SSH keys, services and outbound connections.
- Reset passwords for root and other local accounts that use passwords, from a trusted recovery environment.
- Rotate secrets: database passwords, S3 access keys, cloud tokens, any keys in the root S3 configuration file, and anything typed in root’s shell history.
- Replace root’s SSH private keys and remove the old public keys from every system that trusted them.
- Reset your OPSShield billing password as a precaution and turn on two-factor login.
If OPSShield contacted you to say the attacker logged in to your server by hand, the company recommends rebuilding the server from a clean backup taken before November 1. OPSShield has published indicators of compromise and offered help with cleanup, so follow its official notice for exact steps.
What if I just use a website on shared hosting?
If your website is on shared hosting, you can’t check the server yourself. Ask your host whether it uses cPGuard and whether it was affected. As a precaution, change your hosting, database and WordPress admin passwords, and enable two-factor login where possible. For general steps, see our 10-minute checklist.
Why this matters
This is a supply chain attack: the attacker didn’t hack each server, but poisoned the tool that servers trust. We saw the same idea in the Cursor extension backdoor. Security software runs with high privileges, so when it is compromised, the damage can be large.
Frequently asked questions
What is cPGuard?
cPGuard is a security suite for Linux web hosting servers, made by OPSShield.
Which cPGuard versions were malicious?
Versions 5.88.12 through 5.88.19, uploaded on November 2, 2026. Version 5.88.26 or later is the clean update.
Was my server affected?
Only servers that checked for updates during the roughly 70-minute window on November 2 received the fake update. Check your installed version and look for the hidden root shell.
What data was stolen from OPSShield itself?
Records for about 7,900 customers, including name, company, address, email and a hashed password.
