Indian IT security firm OpsShield suffered a supply chain attack on November 2, 2026, that pushed malicious cPGuard updates to customers for roughly 70 minutes. Attackers broke into its billing and licensing server, then used a stolen key to plant infected versions (5.88.12–5.88.19) of its Linux web hosting security tool on the update CDN.
About 2,950 servers ran the fake updates as root, which also planted a hidden root shell. OpsShield says every password hash, root SSH key, MySQL root password, and shell history on those servers should be treated as compromised. The attackers also copied about 7,900 customer account records with names, companies, addresses, emails, and hashed passwords.
OpsShield has evicted the attackers, is reissuing all cPGuard license keys, and has released versions 5.88.25 and later to remove the root shell. A follow-up update clears a leftover scheduled task. Admins whose servers were online during the window should update and rotate those credentials, and every customer should reset their billing portal password.
Source: SecurityWeek
