NewsPublished 4 Nov 2026

Malicious cPGuard Updates Served in OpsShield Supply Chain Attack

Source SecurityWeek

supply-chain

Description

OpsShield, an Indian IT security company, suffered a supply chain attack where attackers used compromised credentials to access its update servers and distribute malicious updates of cPGuard versions 5.88.12 to 5.88.19. The malicious updates contained scripts that collected data from customer servers, deployed hidden root shells, and uploaded stolen data to the attackers. Approximately 2,950 servers executed the fake updates during a 70-minute window. The attackers also copied about 7,900 client account records, including sensitive information such as hashed passwords, root SSH keys, and MySQL root passwords. OpsShield has since removed the attackers, reset credentials, rotated keys, and released patched cPGuard versions starting at 5.88.25 that remove the malicious components.

Impact

The attack resulted in widespread compromise of customer servers running cPGuard versions 5.88.12 through 5.88.19, with malicious updates executed as root, leading to potential full system compromise. Sensitive data including password hashes, root SSH keys, MySQL root passwords, and shell histories were exposed. Approximately 2,950 servers were affected, and about 7,900 client account records containing personal and company information were stolen. The presence of hidden root shells on infected servers increases the risk of persistent unauthorized access. Customers must consider all credentials and keys compromised and rotate them accordingly.

Defensive guidance

OpsShield has removed the attackers from all affected infrastructure, reset all secrets and credentials, rotated SSH keys and passwords, and rebuilt critical servers. They have released patched cPGuard versions starting at 5.88.25 that remove the malicious root shell and files. Customers should ensure they have updated to cPGuard 5.88.25 or later, rotate all passwords, SSH keys, and MySQL root passwords, and reset billing portal passwords. If cPGuard was offline during the attack window, the server was not affected by the malicious update. Customers should also review published indicators of compromise to detect any residual infection.

References

securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 Nov 2026, 10:58 UTC

Technical details

References

Community reviews

Related threats