cPGuard supply chain attack: 2,950 servers ran a fake update

The security tool on your web server was the way in. In the cPGuard supply chain attack, attackers broke into OpsShield's update system and pushed a malicious cPGuard update. Servers that checked for updates during a short window ran it as root. The script copied password hashes, database root credentials and SSH files, then left a hidden root shell. OpsShield estimates 2,950 servers ran it.

What actually happened

cPGuard is a Linux server security suite: malware scanning, firewall, attack protection. Hosting companies and admins run it next to cPanel, DirectAdmin and Plesk. BleepingComputer notes Namecheap offers it on VPS and dedicated servers.

Per OpsShield's incident notice, as reported by SecurityWeek and BleepingComputer:

• The entry. The attackers registered a customer account and ordered a free cPGuard trial to study how it talks to the licensing system. Crafted requests then got them command execution on OpsShield's billing and licensing server.
• The poison. With a stolen access key, they uploaded a fake update. Versions 5.88.12 through 5.88.19 carried the malicious script. The attack started November 2 at 02:06 UTC. The fake updates were live for about 70 minutes, and OpsShield caught it within 12 hours.
• The payload. The script took Linux password hashes, MySQL/MariaDB root config, root shell history and root SSH files. It uploaded them to OpsShield's own licensing server through a compromised account. It also planted a hidden root shell.
• The rest. The attackers also copied about 7,900 client account records with names, companies, addresses, emails and hashed passwords.

OpsShield's line: "If cPGuard was not online during that window, your server did not receive the fake update. You should still reset your billing portal password."

Why the cPGuard attack matters for your business

You may run cPGuard without having chosen it. If your site is on a managed VPS or a reseller host, ask what's on the box.

If you run cPGuard:

1. Update to 5.88.25 or later. That removes the hidden shell and the dropped files.
2. Check the install log at /opt/cpguard/logs/install_log for versions 5.88.12–5.88.19.
3. If you were hit, rotate everything the script read. Updating does not un-steal credentials. That means system passwords, MySQL root, root SSH keys, cloud secrets, and anything that ever appeared in root's shell history.
4. Reset your OpsShield billing password either way.

The bigger lesson: auto-update is a trust decision. Any agent that runs as root and pulls code from a vendor makes that vendor's security part of yours. Keep an inventory of what auto-updates as root on your servers, and keep it short.

Sources: SecurityWeek, BleepingComputer.