Attackers compromised OpsShield’s cPGuard update infrastructure and used it to distribute a backdoor and data-stealing script, the company said. The incident began on November 2, 2026, at 02:06 UTC and affected versions 5.88.12 through 5.88.19. OpsShield said it detected the intrusion and stopped the malicious distribution within 12 hours of the compromised updates being pushed.
The attacker gained access to the company’s content delivery network using legitimate credentials. OpsShield has not determined how those credentials were obtained. Servers that checked for updates during the affected period may have received a script designed to collect Linux password hashes, database configuration, root shell history, and SSH authorization and known-hosts files.
The stolen information was uploaded to OpsShield’s licensing server through a compromised account. The company said its investigation found evidence that the attacker retrieved 32 files from each customer, but it has not established what information was collected from every server. OpsShield told BleepingComputer that 2,946 servers were affected and that its billing system database was also copied.
OpsShield advises administrators to update cPGuard to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys that may have been exposed. The vendor says the update removes the backdoor and staged files, but warns that potentially stolen credentials must also be invalidated. It plans to issue a further update to remove previously installed OpsShield support-access keys.
Sources: BleepingComputer.