Which cPGuard updates were affected?

Updates 5.88.12 through 5.88.19 inclusive were affected.

How many customer servers had data retrieved?

OPSSHIELD estimates 32 collected files were retrieved, one per server, as a preliminary figure.

ResourcesBlog

cPGuard Update Channel Compromise: Malicious Script in Updates 5.88.12 to 5.88.19

A compromised update channel sent a malicious script to cPGuard servers. Update to 5.88.25 or later, check the indicators, and rotate exposed secrets.

Leonard EserePublished 2026-11-03Reading time 5 min

Filed undercPGuard supply chain update channel incident response server security evidence

cPGuard Update Channel Compromise: Malicious Script in Updates 5.88.12 to 5.88.19

Summary

OPSSHIELD reports a malicious script in cPGuard updates 5.88.12 through 5.88.19.
The script collected system passwords, database settings, and shell history files.
Update to cPGuard 5.88.25 or later and check for the listed indicators.
Rotate exposed passwords, keys, and tokens from a trusted recovery environment.

What happened

On 2 November 2026 at 02:06 UTC, an attacker used compromised credentials. The attacker reached OPSSHIELD update distribution infrastructure. That infrastructure is a content delivery network (CDN). The attacker sent a malicious script through the cPGuard update channel. Affected updates were cPGuard 5.88.12 through 5.88.19 inclusive. OPSSHIELD detected the compromise within 12 hours. How the attacker obtained the credentials remains under investigation.

What the script collected

The script collected password and shadow files from each server. It collected root MariaDB and MySQL configuration files. It collected the root my.cnf database configuration file. It collected root shell history files. It collected root Secure Shell (SSH) authorization files. It collected root SSH known hosts files. It uploaded the files to the OPSSHIELD licensing server. It used a compromised account on that server for later retrieval. The attacker retrieved some of the collected data. On 3 November 2026, OPSSHIELD estimated 32 collected files were retrieved. Each file corresponded to one customer server. That figure is preliminary, not a total count of affected servers.

Indicators to check

Check for the script file cpguard-v58812-i91511.sh. Check for the backdoor file at /var/tmp/.cpg91511_sh. Check for the collection directory at /var/tmp/.cpg91511. Check for the archive at /var/tmp/.cpg91511/loot.tgz. Check the install log at /opt/cpguard/logs/install_log for Successfully updated.

What to do

Run the cpgcli update command with the start option. Confirm the cpgcli version reads 5.88.25 or later. Version 5.88.25 or later removes the known backdoor and staged files. Reset root passwords from a trusted recovery environment. Reset passwords for password enabled local accounts from the same environment. Rotate database passwords, S3 (Simple Storage Service) keys, and DigitalOcean tokens. Rotate secrets found in shell history files. Replace private keys in /root/.ssh and remove old public keys. OPSSHIELD does not routinely recommend a full rebuild at this stage. That position is provisional, so watch for a later advisory update. OPSSHIELD is also releasing an update to remove support access keys.

The governance lesson

An update channel is part of the system, not outside it. A server inventory must list the update channel and its version. Evidence must show the installed version, the check date, and the fix. A version list that stops at install time misses this event. Record each check, each indicator result, and each rotation. PolicyCortex does not clean compromised servers. PolicyCortex helps teams link proof to requirements.

Sources

OPSSHIELD advisory, cPGuard update channel compromise. https://opsshield.com/notice/cpguard-update-channel-compromise.html
Cybersecurity News coverage, November 3, 2026. https://cybersecuritynews.com/cpguard-supply-chain-attack/
SecurityOnline coverage, November 3, 2026. https://securityonline.info/cpguard-supply-chain-attack/
Original diagram by PolicyCortex

Next step

Want server and update evidence linked to each requirement? See how PolicyCortex collects it from live systems.

Questions on this record

Which cPGuard updates were affected?: Updates 5.88.12 through 5.88.19 inclusive were affected.
What is the corrective update?: Version 5.88.25 or later removes the known backdoor and staged files.
How many customer servers had data retrieved?: OPSSHIELD estimates 32 collected files were retrieved, one per server, as a preliminary figure.
Does OPSSHIELD recommend a full rebuild?: No. OPSSHIELD does not routinely recommend a full rebuild at this stage.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state: Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change: Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency: Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture: Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.