Security notice

Does your web host use cPGuard? A fake update took root secrets from about 2,950 servers. Ask your host today.

What happened

• The break-in. OPSSHIELD's disclosure of November 3 says the attacker signed up as a customer on November 1, got the ability to run commands on its billing and licensing server (manage.opsshield.com) that evening, took the keys OPSSHIELD uses to publish updates, and uploaded a fake cPGuard update between 02:04 and 02:09 UTC on November 2. OPSSHIELD says its logs do not show the exact request that let the attacker in, that it has patched two possible entry points, and that the investigation continues. (OPSSHIELD disclosure)
• The fake update. OPSSHIELD says cPGuard agents installed it between 02:08 and 03:20 UTC on November 2 and that it ran as root. It read /etc/shadow and /etc/passwd (local password hashes), root's SSH keys under /root/.ssh, /root/.my.cnf (the MySQL root password) where present, root's shell history, which often holds typed passwords and tokens, and, on a small number of servers, cloud storage keys in /root/.s3cfg. (OPSSHIELD disclosure)
• What it left behind. A hidden root shell at /var/tmp/.cpg91511_sh, and a scheduled task at /etc/cron.d/i93677 with files in /var/tmp/.i93677/. OPSSHIELD's earlier advisory also names a collection folder, /var/tmp/.cpg91511. OPSSHIELD says its clean update 5.88.26 removes the hidden root shell and that a follow-up update removes the scheduled task. (OPSSHIELD disclosure, OPSSHIELD advisory)
• How many servers. About 2,950, says OPSSHIELD's disclosure, and a spokesperson told BleepingComputer that 2,946 servers were affected. OPSSHIELD's earlier advisory estimated that the attacker had retrieved 32 collected files, each from one customer server, and called that a preliminary count of confirmed retrieval, not the number of servers involved. Its later disclosure says any server that had cPGuard online during the window should assume its root-level secrets are known to the attacker. (OPSSHIELD disclosure, OPSSHIELD advisory, BleepingComputer)
• OPSSHIELD's own customer records. The attacker also took a copy of about 7,900 billing portal accounts: name, company, postal address, email and password, stored as bcrypt hashes. OPSSHIELD asks everyone to reset their manage.opsshield.com password and turn on two-factor login. (OPSSHIELD disclosure)
• The two OPSSHIELD notices do not fully agree. The earlier advisory says the attacker got into OPSSHIELD's update distribution (CDN) with compromised credentials at 02:06 UTC, that collected data went to OPSSHIELD's own licensing server for the attacker to pick up, and that it found the attack within 12 hours. Its example update log runs to 12:46 UTC. The later disclosure gives a 70 minute install window and says the data went to a server the attacker controlled. We follow the later disclosure, but treat any server that installed 5.88.12 to 5.88.19 as affected, whatever the time. (OPSSHIELD advisory, OPSSHIELD disclosure)
• Which version fixes it. The earlier advisory says to update to 5.88.25 or later. The later disclosure names 5.88.26 as the clean update. Use 5.88.26 or later. (OPSSHIELD advisory, OPSSHIELD disclosure)
• What we do not know. OPSSHIELD says that beyond the data collection and the backdoor it has found no other malicious activity, a finding it calls preliminary. Its disclosure also tells customers it has contacted about hands-on logins by the attacker to rebuild those servers, and does not say how many there are. We found no public report naming a website that was taken over. There is no CVE number: this was a break-in at the vendor, not a bug in a website plugin. (OPSSHIELD advisory, OPSSHIELD disclosure)

Who should worry

This is about the server your website lives on, not about your website's own software. cPGuard is sold to web hosts and server administrators; BleepingComputer reports that Namecheap offers it on VPS and dedicated servers. Ask about this if any of these are true:

• Your website or online store is on shared hosting, a VPS or a dedicated server, and you do not know what security software your host runs on it.
• You run your own Linux server with cPanel, DirectAdmin, Plesk or another panel and installed cPGuard.
• You have an account on OPSSHIELD's billing portal, manage.opsshield.com.
• You run a web agency or host and look after servers for clients.

If neither you nor your host uses cPGuard, this notice does not apply to you.

What to do now

If someone else runs your server (most website owners).

1. Ask your host whether your server runs cPGuard, whether it installed any version from 5.88.12 to 5.88.19, and what it has done since. You can send the message below.
2. If it did, ask your host whether you need to set new passwords for your hosting account, FTP or SFTP, and your site's database, since OPSSHIELD says root and every local account password on an affected server should be reset and database passwords rotated. (OPSSHIELD advisory, OPSSHIELD disclosure)
3. Check your site. Look for WordPress or store administrator accounts and files you did not add. OPSSHIELD's list of signs also includes files in a web root named in an "i9" pattern, such as i90573_sh.php and i90248_probe.txt. It does not say whether those were found on customer servers. (OPSSHIELD disclosure)

If you run a server with cPGuard yourself. These steps follow OPSSHIELD's advisory and disclosure.

1. Check the update history. Run grep 'Successfully updated' /opt/cpguard/logs/install_log. Any entry for 5.88.12 to 5.88.19 means the server installed an affected update, even if it now runs a newer one. OPSSHIELD says no match, or a missing or incomplete log, does not prove the server was unaffected. (OPSSHIELD advisory)
2. Update. Run cpgcli update --start, then cpgcli --version, and confirm 5.88.26 or later. If the update fails, contact OPSSHIELD Support. (OPSSHIELD advisory, OPSSHIELD disclosure)
3. Confirm the left-behind files are gone: /etc/cron.d/i93677, /var/tmp/.i93677/, /var/tmp/.cpg91511_sh and /var/tmp/.cpg91511. Delete them if not. OPSSHIELD says their absence does not show whether the script ran. (OPSSHIELD disclosure, OPSSHIELD advisory)
4. If cPGuard was online in the window, treat the server as compromised. From a trusted recovery environment, reset the root password and every local account password, and change those passwords anywhere else they were reused. Change the MySQL root password and database passwords. Rotate S3 keys, DigitalOcean tokens and anything else that appears in root's shell history or /root/.s3cfg. Make new root SSH keys, remove the old public keys from every server that trusted them, check authorized_keys for anything you do not recognize, and treat servers reached with those keys as exposed. (OPSSHIELD advisory, OPSSHIELD disclosure)
5. Support access. OPSSHIELD is releasing an update that removes its own support-access keys from servers where they were added. The Hacker News notes that OPSSHIELD has not said whether the matching private key was exposed. Check root's authorized_keys after that update. (OPSSHIELD advisory, The Hacker News)
6. Rebuild only when told or when in doubt. OPSSHIELD is not recommending a routine rebuild, and calls that view provisional. If OPSSHIELD told you the attacker logged in to your server by hand, rebuild it from a clean backup taken before November 1. If you find other signs of compromise, ask OPSSHIELD Support for a review. (OPSSHIELD advisory, OPSSHIELD disclosure)
7. Reset your manage.opsshield.com password and turn on two-factor login, whether or not your servers were affected. (OPSSHIELD disclosure)

What to send your host

OPSSHIELD says an attacker published fake cPGuard updates, versions 5.88.12 to 5.88.19, on November 2, 2026 (installs between 02:08 and 03:20 UTC), which ran as root on about 2,950 servers, copied /etc/shadow, root SSH keys, /root/.my.cnf and root shell history, and left a root shell at /var/tmp/.cpg91511_sh and a scheduled task at /etc/cron.d/i93677. Does the server my site is on run cPGuard? If so, did it install any of those versions, is it now on 5.88.26 or later, and have root and local account passwords, database passwords, SSH keys and other secrets been rotated as OPSSHIELD advises? Do I need to set new passwords for my hosting account, FTP or SFTP, or my site's database? Thank you. Sources: OPSSHIELD disclosure, OPSSHIELD advisory.

Common questions

Sources

• OPSSHIELD: Security Incident Disclosure: manage.opsshield.com, November 3, 2026, checked November 4, 2026
• OPSSHIELD: cPGuard security advisory: Update channel compromise, published November 3, 2026 (IST), checked November 4, 2026
• BleepingComputer: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data, checked November 4, 2026
• The Hacker News: cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes, checked November 4, 2026
• Help Net Security: Poisoned cPGuard update hits thousands of web hosting servers, November 4, 2026, checked November 4, 2026