--- title: Hackers hijack cPGuard autoupdate to deploy backdoor,... description: Attackers compromised the update infrastructure for the cPGuard Linux web-server security suite to push a backdoor and data-stealing script. OpsShield says the... canonical: https://daily.dev/posts/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data-hp4wcw6ua twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data | daily.dev og:description: Attackers compromised the update infrastructure for the cPGuard Linux web-server security suite to push a backdoor and data-stealing script. OpsShield says the... og:url: https://daily.dev/posts/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data-hp4wcw6ua og:image: https://api.daily.dev/og/posts/HP4WcW6Ua.png og:image:alt: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers hijack cPGuard autoupdate to deploy backdoor, steal data **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Attackers compromised the update infrastructure for the cPGuard Linux web-server security suite to push a backdoor and data-stealing script. OpsShield says the attack started on November 2 at 02:06 UTC, using compromised credentials, and hit versions 5.88.12 through 5.88.19. The vendor says it detected the compromise and stopped the malicious distribution within 12 hours after the compromised versions were pushed. The script targeted Linux password hashes, root database configs, root shell history, and root SSH keys, and the threat actor retrieved 32 files from each customer. OpsShield told BleepingComputer 2,946 servers were affected, including its own billing database. Admins should update to 5.88.25 or later and rotate all exposed credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happened in the cPGuard update server compromise in November 2026? Attackers used compromised credentials to access OpsShield's cPGuard CDN update distribution infrastructure starting November 2, 2026 at 02:06 UTC, and pushed a malicious script through versions 5.88.12 through 5.88.19. OpsShield detected and stopped it within 12 hours. The attack affected 2,946 servers, and the script stole Linux password hashes, root database configs, root shell history, and root SSH keys. _Teams running cPGuard can track supply chain incidents like this one on daily.dev as fixes land._ ### How do I fix my server after the cPGuard supply chain attack? Update cPGuard to version 5.88.25 or later, which removes the backdoor and staged malicious files, then reset passwords and rotate database credentials, cloud secrets, and SSH keys since the update alone does not invalidate stolen credentials. OpsShield also plans a further update to remove previously installed support-access keys. _Admins patching compromised infrastructure can follow remediation steps like these via daily.dev._ ### What data did the cPGuard backdoor steal from compromised servers? The malicious script targeted Linux password hashes, root MariaDB/MySQL database configuration, root shell history, and root SSH authorization and known-hosts files. Investigators found the attacker retrieved 32 files from each affected customer, and the stolen data was uploaded to OpsShield's own licensing server via a compromised account. _daily.dev helps security teams stay on top of supply chain breaches affecting their stack._ ## Similar posts on daily.dev - [How GitGuardian Enables Rapid Response to the LiteLLM Supply Chain Attack](https://daily.dev/posts/how-gitguardian-enables-rapid-response-to-the-litellm-supply-chain-attack-pcfnnzdvq) · GitGuardian · 0 upvotes · 0 comments - [WordPress sites compromised after TeamUpdraft credential exposure](https://daily.dev/posts/wordpress-sites-compromised-after-teamupdraft-credential-exposure-5zodckkmr) · CSO Online · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#linux](https://daily.dev/tags/linux), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data-hp4wcw6ua) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers hijack cPGuard autoupdate to deploy backdoor, steal data","url":"https://daily.dev/posts/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data-hp4wcw6ua","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data-hp4wcw6ua"},"datePublished":"2026-11-03T22:23:40.755Z","dateModified":"2026-11-05T03:47:42.604Z","description":"Attackers compromised the update infrastructure for the cPGuard Linux web-server security suite to push a backdoor and data-stealing script. OpsShield says the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/797b97e8f57b4b304e19f3dae1182a6b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/797b97e8f57b4b304e19f3dae1182a6b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data-hp4wcw6ua","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,linux,ssh","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hackers hijack cPGuard autoupdate to deploy backdoor, steal data"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data-hp4wcw6ua#faq","mainEntity":[{"@type":"Question","name":"What happened in the cPGuard update server compromise in November 2026?","acceptedAnswer":{"@type":"Answer","text":"Attackers used compromised credentials to access OpsShield's cPGuard CDN update distribution infrastructure starting November 2, 2026 at 02:06 UTC, and pushed a malicious script through versions 5.88.12 through 5.88.19. OpsShield detected and stopped it within 12 hours. The attack affected 2,946 servers, and the script stole Linux password hashes, root database configs, root shell history, and root SSH keys. Teams running cPGuard can track supply chain incidents like this one on daily.dev as fixes land."}},{"@type":"Question","name":"How do I fix my server after the cPGuard supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Update cPGuard to version 5.88.25 or later, which removes the backdoor and staged malicious files, then reset passwords and rotate database credentials, cloud secrets, and SSH keys since the update alone does not invalidate stolen credentials. OpsShield also plans a further update to remove previously installed support-access keys. Admins patching compromised infrastructure can follow remediation steps like these via daily.dev."}},{"@type":"Question","name":"What data did the cPGuard backdoor steal from compromised servers?","acceptedAnswer":{"@type":"Answer","text":"The malicious script targeted Linux password hashes, root MariaDB/MySQL database configuration, root shell history, and root SSH authorization and known-hosts files. Investigators found the attacker retrieved 32 files from each affected customer, and the stolen data was uploaded to OpsShield's own licensing server via a compromised account. daily.dev helps security teams stay on top of supply chain breaches affecting their stack."}}]} ```