--- title: Attackers turned OpsShield’s trusted update channel into... description: Attackers compromised OpsShield's update distribution system and pushed a malicious cPGuard update that ran with root access on customer servers. Between... canonical: https://daily.dev/posts/attackers-turned-opsshield-s-trusted-update-channel-into-a-supply-chain-attack-bepkcrijc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Attackers turned OpsShield’s trusted update channel into a supply-chain attack | daily.dev og:description: Attackers compromised OpsShield's update distribution system and pushed a malicious cPGuard update that ran with root access on customer servers. Between... og:url: https://daily.dev/posts/attackers-turned-opsshield-s-trusted-update-channel-into-a-supply-chain-attack-bepkcrijc og:image: https://api.daily.dev/og/posts/bePkCRiJC.png og:image:alt: Attackers turned OpsShield’s trusted update channel into a supply-chain attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Attackers turned OpsShield’s trusted update channel into a supply-chain attack **[CSO Online](https://daily.dev/sources/csoonline)** · 7 min read · 0 upvotes · 0 comments ## Summary Attackers compromised OpsShield's update distribution system and pushed a malicious cPGuard update that ran with root access on customer servers. Between November 1 and 2, for about 70 minutes, the fake update ran on roughly 2,950 servers, exposing password hashes, root SSH keys, MySQL root passwords, and shell history. Attackers also accessed around 7,900 billing portal accounts with names, addresses, emails, and hashed passwords, plus copies of three OpsShield cloud servers. OpsShield has released a clean update, v5.88.26, and is urging customers to change passwords, replace SSH keys, and rotate tokens found in shell histories, and to rebuild any server the attacker logged in to by hand. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What files should I check on my server to confirm if the cPGuard update compromise affected me? Administrators should confirm whether /etc/cron.d/i93677, /var/tmp/.i93677/, and /var/tmp/.cpg91511_sh exist on the server, and delete them if found. These were left behind by the malicious update pushed through OpsShield's compromised distribution channel. If the files are present, root passwords, SSH keys, MySQL passwords, and any credentials in shell history should be treated as compromised and rotated. _Admins tracking supply-chain incidents like this one can follow remediation steps as they unfold on daily.dev._ ### How long was the malicious OpsShield cPGuard update live and how many servers were affected? The malicious update was pushed for about 70 minutes between November 1 and 2, after attackers gained unauthorized access to OpsShield's update distribution infrastructure using compromised credentials. Roughly 2,950 customer servers ran the fake update, which executed as root and exposed password hashes, root SSH keys, MySQL root passwords, and shell history on each affected machine. _Teams assessing exposure from trusted vendor updates can track incident details like this on daily.dev._ ### Why is it risky when a security tool like an antivirus or server protection agent updates itself with root privileges? A security agent running as root needs broad system visibility to do its job, but that same privilege means a compromised update can access everything on the server, including MySQL root passwords, SSH keys trusted by other servers, and shell history containing typed credentials. In the OpsShield case, a single compromised update channel gave attackers root access across thousands of servers at once, rather than requiring them to breach each one individually. _Developers evaluating vendor risk from root-level agents can follow deep dives like this on daily.dev._ ## Similar posts on daily.dev - [How GitGuardian Enables Rapid Response to the LiteLLM Supply Chain Attack](https://daily.dev/posts/how-gitguardian-enables-rapid-response-to-the-litellm-supply-chain-attack-pcfnnzdvq) · GitGuardian · 0 upvotes · 0 comments - [Black October, Ashwathama’s Night Raid, and the Owl](https://daily.dev/posts/black-october-ashwathama-s-night-raid-and-the-owl-sfyfad9ab) · Medium · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#linux](https://daily.dev/tags/linux), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/attackers-turned-opsshield-s-trusted-update-channel-into-a-supply-chain-attack-bepkcrijc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Attackers turned OpsShield’s trusted update channel into a supply-chain attack","url":"https://daily.dev/posts/attackers-turned-opsshield-s-trusted-update-channel-into-a-supply-chain-attack-bepkcrijc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/attackers-turned-opsshield-s-trusted-update-channel-into-a-supply-chain-attack-bepkcrijc"},"datePublished":"2026-11-05T03:06:01.164Z","dateModified":"2026-11-05T03:47:42.616Z","description":"Attackers compromised OpsShield's update distribution system and pushed a malicious cPGuard update that ran with root access on customer servers. Between...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee962d6ba086876fac31c78ababad400?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ee962d6ba086876fac31c78ababad400?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/attackers-turned-opsshield-s-trusted-update-channel-into-a-supply-chain-attack-bepkcrijc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,linux,ssh","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Attackers turned OpsShield’s trusted update channel into a supply-chain attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/attackers-turned-opsshield-s-trusted-update-channel-into-a-supply-chain-attack-bepkcrijc#faq","mainEntity":[{"@type":"Question","name":"What files should I check on my server to confirm if the cPGuard update compromise affected me?","acceptedAnswer":{"@type":"Answer","text":"Administrators should confirm whether /etc/cron.d/i93677, /var/tmp/.i93677/, and /var/tmp/.cpg91511_sh exist on the server, and delete them if found. These were left behind by the malicious update pushed through OpsShield's compromised distribution channel. If the files are present, root passwords, SSH keys, MySQL passwords, and any credentials in shell history should be treated as compromised and rotated. Admins tracking supply-chain incidents like this one can follow remediation steps as they unfold on daily.dev."}},{"@type":"Question","name":"How long was the malicious OpsShield cPGuard update live and how many servers were affected?","acceptedAnswer":{"@type":"Answer","text":"The malicious update was pushed for about 70 minutes between November 1 and 2, after attackers gained unauthorized access to OpsShield's update distribution infrastructure using compromised credentials. Roughly 2,950 customer servers ran the fake update, which executed as root and exposed password hashes, root SSH keys, MySQL root passwords, and shell history on each affected machine. Teams assessing exposure from trusted vendor updates can track incident details like this on daily.dev."}},{"@type":"Question","name":"Why is it risky when a security tool like an antivirus or server protection agent updates itself with root privileges?","acceptedAnswer":{"@type":"Answer","text":"A security agent running as root needs broad system visibility to do its job, but that same privilege means a compromised update can access everything on the server, including MySQL root passwords, SSH keys trusted by other servers, and shell history containing typed credentials. In the OpsShield case, a single compromised update channel gave attackers root access across thousands of servers at once, rather than requiring them to breach each one individually. Developers evaluating vendor risk from root-level agents can follow deep dives like this on daily.dev."}}]} ```