By Hamza Faisal

The security software meant to protect Linux web hosting servers became the attack itself this week. OPSSHIELD, the company behind the cPGuard security suite, has confirmed that an attacker compromised its update distribution infrastructure and pushed a malicious script to customer servers through the product's normal update channel.

According to OPSSHIELD's advisory, published on November 3, the attacker used compromised credentials to access the company's update system on November 2 at 02:06 UTC. For more than 70 minutes, cPGuard agents on customer servers downloaded and installed what they believed was a routine update — versions 5.88.12 through 5.88.19 — and ran it with root privileges.

OPSSHIELD says it detected the attack within 12 hours and stopped further distribution. But by then, BleepingComputer reports, about 2,946 servers had already installed the poisoned update. Some servers may have escaped the bad window, but the vendor warns timing alone does not prove a server is clean.

A security tool turned into the attack

cPGuard runs with root privileges on hosting servers alongside panels such as cPanel, DirectAdmin and Plesk, monitoring for malware and intrusions. That trusted position made the compromise so dangerous: the script arrived through a channel administrators trust, from the vendor's own infrastructure.

The incident began a day earlier, on November 1, when the attacker probed OPSSHIELD's billing portal. Per Help Net Security's account of the advisory, the attacker registered under a false identity, ordered a free trial, and studied how the agent talks to the licensing system. Crafted requests to the billing portal's callback pages then let the attacker run commands on the billing server, collecting records for about 7,900 customers: names, companies, addresses, emails and bcrypt-hashed passwords.

What the malicious update stole

On every server that installed the poisoned update, the script gathered the files an attacker needs to own a machine outright: the local account files /etc/passwd and /etc/shadow, the root MariaDB or MySQL configuration, root shell history, and root SSH authorization and known-hosts files. It also swept up cloud storage keys where present.

The stolen data was uploaded to OPSSHIELD's own licensing server under a compromised account for later retrieval. As of November 3, the vendor estimated the attacker had pulled 32 collected files, one per customer server — a figure that could still grow.

Alongside the theft, the script left a hidden root shell at /var/tmp/.cpg91511_sh, with files in /var/tmp/.i93677/ — a way back in even after the update was gone.

Updating is not enough

OPSSHIELD has released a clean update — version 5.88.25, with a follow-up build removing the scheduled task — that deletes the backdoor and staged files. Administrators can check their update history in /opt/cpguard/logs/install_log: any entry for versions 5.88.12 through 5.88.19 means the bad update was installed.

But updating removes the backdoor; it does not invalidate anything already stolen. Every credential the script could reach — root passwords, database passwords, SSH keys and cloud tokens — must be rotated, and servers should be checked for backdoor artifacts before the clean update wipes them away.

No CVE has been assigned, because no software bug was exploited: this was a compromise of the vendor's infrastructure, not a flaw in a cPGuard release. OPSSHIELD says it has revoked the stolen update key and cloud API tokens, removed the attacker's SSH key and cloned servers, and strengthened login protection. For hosting providers, the lesson is stark: when the update channel itself is compromised, the tool trusted to keep a server safe can deliver the attacker straight to its door.

By Hamza Faisal