Poisoned cPGuard update hits thousands of web hosting servers

OPSShield’s cPGuard update infrastructure was compromised and attacker-signed fake updates (v5.88.12–5.88.19) were pushed on 2 November 2026, resulting in malicious scripts executed as root on ~2,950 servers which collected and exfiltrated password hashes, root SSH keys, MySQL credentials, shell histories and cloud keys; the attacker also accessed the billing/licensing server and stole contact records and bcrypt-hashed passwords for about 7,900 customers. OPSShield revoked keys, published a clean update (v5.88.26) to remove backdoors, rotated credentials and is rebuilding affected systems; customers are advised to update, validate removal of the malicious scheduled task and root shell, rotate all exposed credentials and rebuild compromised servers from known-good backups.