Ethical Hacking News
A critical security alert has been issued for cPGuard users, following the discovery of a vulnerability that allowed an attacker to install a backdoor on Linux servers and collect sensitive files, including password hashes. The affected update channel was compromised, and the malicious script was uploaded to a licensing server run by OPSSHIELD itself, using compromised credentials. To mitigate this risk, cPGuard administrators are advised to update their servers to the latest version and take additional security measures to protect their systems.
The cPGuard security tool's update channel was compromised, allowing an attacker to inject a malicious script. The malicious script installed a backdoor on Linux servers and collected sensitive files, including password hashes. The attack was detected within 12 hours, and OPSSHIELD has cleared its infrastructure credentials and stopped the script from reaching more servers. Admins are advised to update to version 5.88.25 or later, reset passwords, and rotate database passwords to remove the backdoor and sensitive files. OPSSHIELD has released another update to remove support-access keys from cPGuard servers to prevent potential exploitation. The discovery highlights the importance of regular software updates and robust cybersecurity measures to prevent similar attacks in the future.
The cybersecurity landscape has recently been dealt a severe blow with the discovery of a critical vulnerability in the cPGuard security tool. The update channel of this popular security solution was compromised, allowing an attacker to inject a malicious script that installed a backdoor on Linux servers and collected sensitive files, including password hashes.
According to the latest advisory from OPSSHIELD, the cPGuard security tool was used to send a malicious script to customers' Linux servers on November 2. The script, which was installed on versions 5.88.12 through 5.88.19 of the cPGuard software, enabled the attacker to gain access to the update system and subsequently collect sensitive data from affected servers. The compromised credentials used in the attack were obtained through a combination of brute-force and phishing attacks.
The malicious script, which was later identified as cpguard-v58812-i91511.sh, was uploaded to a licensing server run by OPSSHIELD itself, using a compromised account. This allowed the attacker to pick up the data, which was later stolen. The attack was detected within 12 hours of the affected versions going out, and OPSSHIELD has since cleared its infrastructure credentials and stopped the script from reaching more servers.
The impact of this attack cannot be overstated, as it has left many Linux servers vulnerable to potential exploitation. The script collected sensitive files, including the root's MariaDB or MySQL configuration, root's shell history, and the SSH authorization and known-hosts files for root. It is essential to note that the company is still investigating how the attacker obtained the compromised credentials.
OPSSHIELD has provided guidance for cPGuard administrators to update every server to the latest version (5.88.25 or later) to remove the backdoor and the files the script left behind. Additionally, administrators are advised to reset the passwords for root and every other local Linux account that uses a password, rotate database passwords, S3 access keys, DigitalOcean tokens, and any secrets recorded in root's shell history.
Furthermore, OPSSHIELD has released another update to remove its support-access keys from cPGuard servers where they were added earlier. This is a precautionary measure to prevent any potential exploitation of the compromised credentials.
The discovery of this critical vulnerability highlights the importance of regular software updates and the need for robust cybersecurity measures to prevent similar attacks in the future. As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and take proactive steps to protect their systems from potential threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Security-Alert-cPGuard-Update-Channel-Hijacked-to-Enable-Backdoor-Access-and-Collect-Password-Hashes-ehn.shtml
https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html
Published: Tue Nov 3 12:06:07 2026 by llama3.2 3B Q4_K_M
