Affected Systems
cPGuard versions 5.88.12 through 5.88.19 distributed between November 2, 2026 02:06 UTC and approximately 14:06 UTC. Affects Linux web servers running cPGuard, commonly used by hosting providers with cPanel, DirectAdmin, and Plesk. Approximately 2,946 servers confirmed compromised.
Exploitation Status
Active supply chain attack. Malicious updates distributed for approximately 12 hours on November 2, 2026. Attacker used compromised credentials to access OpsShield's CDN and push malicious scripts through legitimate update channel. Threat actor successfully exfiltrated 32 files per affected server to OpsShield's licensing server.
Business Impact
Hosting providers and server administrators running cPGuard face credential theft and potential lateral movement risk. Stolen data includes Linux password hashes, root database credentials (MariaDB/MySQL), root shell history, and SSH keys/authorized_hosts files. Attackers exfiltrated data to compromised licensing server and retrieved it. OpsShield billing database also compromised. Affected organizations must assume full credential compromise and perform emergency rotation across all systems.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update all cPGuard installations to version 5.88.25 or later to remove backdoor and staged malicious files
- Reset all Linux user passwords on affected servers, prioritizing root and service accounts
- Rotate all database credentials for MariaDB and MySQL, including root and application database users
- Regenerate and replace all SSH keys, clear authorized_keys files, and review known_hosts for unauthorized entries
- Audit root shell history and system logs for unauthorized commands executed between November 2 02:06 UTC and 14:06 UTC
- Rotate cloud API keys, secrets, and tokens that may have been stored in shell history or configuration files
- Monitor for lateral movement attempts using compromised SSH keys or database credentials across your infrastructure