← OPSSHIELD LLP

2026 OPSSHIELD — attacker hijacked the cPGuard update system and pushed a backdoor script to Linux servers; password hashes and config files taken from at least 32 customer servers

2026 Unknown records affected Share on X

Data compromised

The script collected files from affected servers and uploaded them to an OPSSHIELD licensing server through a compromised account: /etc/shadow and /etc/passwd (password hashes and account data), root's MariaDB or MySQL configuration, root's shell history (which may contain secrets), and root's SSH authorized_keys and known_hosts files. OPSSHIELD has confirmed 32 collected files, each tied to one customer server. It has not said how many servers installed an affected version and says the 32 files are not the full total.

Technical writeup

The malicious script was named cpguard-v58812-i91511.sh. It installed a backdoor shell at /var/tmp/.cpg91511_sh and staged collected data in /var/tmp/.cpg91511 before packaging it as loot.tgz. Servers check for updates at intervals, so some may not have run the script yet. OPSSHIELD has found no other malicious activity so far but says that finding is not final.

Root cause

An attacker broke into OPSSHIELD's update system on November 2, 2026, at 02:06 UTC, using compromised credentials. The attacker pushed a malicious script in cPGuard versions 5.88.12 to 5.88.19, which installed a backdoor shell on affected servers. Versions 5.88.25 and later remove the backdoor and leftover files. OPSSHIELD is still investigating how the credentials were obtained and has not said whether the private key behind its support-access feature was exposed.

References

Breaches you may like