Attackers hijacked the cPGuard security software update channel to steal privileged credentials from about 2,950 customer servers, OpsShield disclosed on November 3, 2026. The vendor said the malicious update ran as root on November 2. BleepingComputer separately reported a company spokesperson confirming 2,946 affected servers.

cPGuard protects Linux web servers with malware scanning and firewall features and is used alongside hosting control panels, according to BleepingComputer. The attack turned its trusted update mechanism into a delivery route for a data-stealing script and backdoor, exposing the systems the software was intended to defend.

In its updated disclosure, OpsShield said the attacker registered a customer account, breached its billing and licensing server, and stole an update-storage access key. Customer agents installed the fake update between 02:08 and 03:20 UTC on November 2. Logs did not capture the exact request that enabled access, leaving the precise entry mechanism unresolved.

OpsShield said the script collected password hashes, root SSH material, database credentials and shell history. Its updated notice also reported exposure of about 7,900 billing accounts, including contact information and hashed passwords. The earlier advisory identified affected updates as versions 5.88.12 through 5.88.19 and cautioned that installation records alone did not establish which files had been transferred.

The updated vendor disclosure identifies clean release 5.88.26 and a follow-up cleanup update. OpsShield tells administrators to install the latest version and verify removal of the hidden root shell and scheduled-task artifacts. Its earlier advisory warns that removing known malicious files does not invalidate credentials copied before cleanup.

OpsShield recommends resetting local passwords, replacing root SSH keys and rotating exposed database and cloud secrets. Administrators should also reset billing portal passwords and enable two-factor authentication. The vendor advises checking other servers reachable with exposed SSH keys and rebuilding systems from clean backups where it has notified customers of manual attacker access.