Hackers turned the update mechanism of a Linux server security tool against its own customers, pushing malicious software that cybersecurity vendor OPSSHIELD says ran on approximately 2,950 servers and collected sensitive credentials.
OPSSHIELD develops cPGuard, security software used by web hosting companies and server administrators to protect Linux servers. The company disclosed Tuesday that attackers breached its billing and licensing infrastructure, stole a software update key and used it to distribute a malicious version of cPGuard.
The attackers also stole account information belonging to approximately 7,900 customers of OPSSHIELD’s billing portal. Those customers include hosting providers that may operate servers for numerous businesses and websites, potentially extending the incident’s impact to organizations that have no direct relationship with OPSSHIELD. The company has not disclosed how many downstream customers or websites may be affected.
From Free Trial to Malicious Update
According to OPSSHIELD’s incident timeline, the intrusion began Nov. 1 when an attacker registered a customer account under a false identity and obtained a free cPGuard trial.
The attacker then studied communications between the software and OPSSHIELD’s licensing infrastructure before sending crafted requests to the company’s billing portal. By late that evening, the attacker had gained command execution on the billing and licensing server.
Early Nov. 2, the intruder used a stolen access key to upload a malicious update. Customer servers installed the update between 02:08 and 03:20 UTC, executing it with root privileges, according to OPSSHIELD’s detailed incident timeline.
The script collected Linux password hashes, root SSH private keys, MySQL administrator credentials and shell history. On some systems, it also accessed cloud storage credentials.
The malicious update also installed a hidden root-level shell and a scheduled task, potentially allowing attackers to maintain access after the initial theft, according to OPSSHIELD’s incident disclosure.
OPSSHIELD’s initial security advisory, published Nov. 3, estimated that the attacker retrieved 32 collected files, each corresponding to a customer server. A more detailed disclosure published later that day estimated that approximately 2,950 servers ran the malicious update. The figures measure different aspects of the compromise and do not establish how much information the attacker ultimately obtained.
The attackers also copied three of OPSSHIELD’s cloud servers, according to the company.
Evidence of Attacks Surface
Hosting administrators are reporting firsthand evidence of the attack. On the Enhance Control Panel community forum, a participant identified as MarkD said SentinelOne telemetry from two affected servers showed the malicious update collecting SSH keys, password hashes and shell history. The security software also recorded successful outbound connections, although the administrator could not establish exactly what data the attackers received.
The compromise has also raised questions about whether corrective updates erased evidence needed for incident investigations. In a LowEndTalk discussion, hosting administrators questioned how they could determine what had been stolen after the cleanup removed malicious files. One Enhance community participant said the incident had destroyed their confidence in cPGuard and prompted a switch to competing security software.
Security Software Becomes the Attack Path
The compromise underscores a dangerous software supply-chain scenario where attackers don’t need to breach customers individually when they can distribute malicious code through trusted software.
Similar attacks have targeted other widely used products. In March, attackers compromised the Trivy vulnerability scanner, stealing credentials that enabled a subsequent breach of security vendor Checkmarx. In a separate campaign disclosed earlier this year, attackers hijacked the Notepad++ update infrastructure to selectively deliver malware. And in 2023, hackers compromised 3CX’s software build environment, distributing malicious versions of its desktop communications application.
Hosting providers and managed service providers describe the potential consequences to extending beyond a single machine. Stolen root SSH keys and database credentials could provide access to other systems that trust those credentials, potentially affecting multiple customers.
OPSSHIELD said it revoked the stolen update key, replaced internal credentials and began rebuilding compromised infrastructure. It also released clean software updates to remove the known malicious components.
OPSSHIELD said the attacker sent specially crafted requests to its billing portal’s callback pages before gaining the ability to execute commands on the billing server. The company patched two suspected entry points in its billing application but said its logs did not capture the exact request that enabled the intrusion, leaving the initial vulnerability unconfirmed.
What cPGuard Customers Need to Check
OPSSHIELD is urging customers to install the latest cPGuard release and check for evidence of the malicious components.
Versions 5.88.12 through 5.88.19 were associated with the original attack. The company subsequently released version 5.88.26 and additional cleanup measures.
Administrators should rotate local account passwords, replace exposed SSH keys, reset database credentials and review secrets stored in shell history or cloud configuration files. They should also examine systems accessible using the potentially stolen SSH credentials.
OPSSHIELD has published indicators of compromise, including attacker IP address 94.183.188.91, a hidden root-level shell at /var/tmp/.cpg91511_sh, a malicious scheduled task at /etc/cron.d/i93677 and fake update scripts matching cpguard-v58812-i91511*.sh. The company also published SHA-256 hashes for four malicious update variants.
Updating the software removes known malicious components, but it does not invalidate credentials already stolen. OPSSHIELD advises customers notified of interactive attacker access to rebuild affected servers from clean backups.
The attacker has not been publicly identified, and the full extent of subsequent misuse remains unclear.
