---
title: OpsShield Hit by Supply Chain Attack, Nearly 3,000 Servers Compromised
description: Hackers hijacked security tool cPGuard's updates, running a credential-stealing script as root on thousands of web hosts. A fix is out.
canonical_url: https://codekeeper.co/ticker/opsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Ransomware](https://codekeeper.co/ticker/tag/ransomware)

# OpsShield Hit by Supply Chain Attack, Nearly 3,000 Servers Compromised

Hackers hijacked security tool cPGuard's updates, running a credential-stealing script as root on thousands of web hosts. A fix is out.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 5, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN. About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords. OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password. Source: [SecurityWeek](https://www.securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fopsshield-hit-by-supply-chain-attack-nearly-3000-servers-compromised%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Fake Bank App Turned Victims’ Own Cards Into Remote ATM Withdrawals Oct 27, 2026](https://codekeeper.co/ticker/dutch-police-arrest-men-ai-bank-fraud)

[Cyberattacks Hacker Group Claims Breach of Trump Mobile Customer Data Oct 6, 2026](https://codekeeper.co/ticker/ransomware-breach-trump-mobile-data-exposed)

[Aflac Japan Data Breach Hits 4.4 Million Customers Aug 12, 2026](https://codekeeper.co/ticker/aflac-japan-data-breach-2023)

[Cyberattacks Iran-Linked Hackers Blamed for Taking a British Power Plant Offline for Four Days Aug 24, 2026](https://codekeeper.co/ticker/iranian-hackers-hit-uk-power-plant)