Poisoned cPGuard update hits thousands of web hosting servers
Attacker compromises cPGuard update infrastructure, pushing malicious update to 3,000 servers.
An attacker compromised the update infrastructure of cPGuard, a security suite for Linux web hosting servers, and distributed a malicious update to nearly 3,000 customer servers. The attacker also exfiltrated customer contact information and hashed passwords from OPSShield's billing and licensing server. The malicious update installed a script that collected sensitive files, including password hashes, SSH keys, and MySQL root passwords, sending them to an attacker-controlled server.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OPSShield?
Get an email when a new story names OPSShield, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn attacker compromised cPGuard's update infrastructure and pushed a malicious update to nearly 3,000 Linux web hosting servers, turning a trusted security tool into a data exfiltration weapon. The malicious script harvested highly sensitive credentials — SSH keys, password hashes, and MySQL root passwords — and sent them to an attacker-controlled server. This incident illustrates the catastrophic trust customers place in software vendors' update pipelines: a single point of failure in the supply chain can simultaneously compromise thousands of downstream environments. The additional breach of OPSShield's billing and licensing server compounded the damage by exposing customer contact information and hashed passwords, underscoring the need to treat update infrastructure as critical, high-value attack surface.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — cPGuard malicious update