OpsShield has disclosed that unknown attackers breached the update distribution infrastructure for its cPGuard web security suite and used it to push a backdoor and a data-stealing script to customers, a campaign the vendor says touched 2,946 servers. The company said the intrusion began on November 2, 2026 at 02:06 UTC and that affected releases ran from version 5.88.12 through 5.88.19. cPGuard is a Linux web-server security suite that provides malware scanning, firewalls, and attack protection, and it is commonly run by hosting providers and server administrators alongside control panels such as cPanel, DirectAdmin, and Plesk. Namecheap offers the product on VPS and dedicated servers.
According to OpsShield, the attacker gained initial access to the company's content delivery network, which handles update distribution, by using legitimate credentials. The vendor has not determined how those credentials were obtained. From that access, the attacker delivered a malicious script through the cPGuard update channel, which then targeted sensitive data on machines that updated during the compromise window.
The stolen information was uploaded to OpsShield's licensing server through a compromised account, and the attackers later retrieved it from there. OpsShield said its investigation has not established exactly what data was taken from each individual server, but evidence shows the threat actor pulled 32 files from every customer. The company also said its billing system database was copied during the incident before the malicious distribution was halted within 12 hours of the compromised versions being pushed. OpsShield noted that some servers may never have received or run the script because update checks occur at set intervals, though it could not confirm that.
In a statement, an OpsShield spokesperson said the company is working to block all access, rebuild the affected systems, and prepare a public announcement as early as possible. The vendor is directing administrators to move every cPGuard server to version 5.88.25 or later, which it says removes the backdoor and staged files. OpsShield is also advising customers to reset passwords and rotate database credentials, cloud secrets, and SSH keys, since stolen credentials must be invalidated even after the software is updated. As an added precaution, the company said it will release an update that removes previously installed OpsShield support-access keys.
More cybersecurity news from TechManNews.
