Attackers hijacked the update channel of cPGuard, a security product for Linux web-hosting servers made by India-based OPSShield, and pushed a script that gathered root-level passwords and keys on about 2,950 customer servers, SecurityWeek reported Wednesday. The case shows how a trusted security tool that updates itself with full administrator rights can hand intruders every machine it protects at once.
What Happened
According to OPSShield’s advisory, an attacker used compromised credentials on Nov. 2 to reach the company’s update-distribution network and publish fake cPGuard releases. The bogus updates were available for about 70 minutes, and the company detected the attack within 12 hours, SecurityWeek reported.
The script ran with root privileges, the highest level of control on a Linux server. OPSShield said it gathered password files, the root database configuration, root’s command history and its remote-login keys, uploaded them to OPSShield’s own licensing server through a compromised account, and left a hidden backdoor. The attackers retrieved collected files from 32 customer servers, according to the company.
OPSShield’s later account, cited by SecurityWeek and Help Net Security, says the intruders first used a free trial to study the licensing system, then gained the ability to run commands on its billing and licensing server. They copied about 7,900 client account records, including names, emails and hashed passwords, plus three company cloud servers.
Why It Matters
A web-hosting server can carry many websites, so one poisoned update can ripple well beyond the provider. Boards should know which outside tools update themselves with administrator rights and how quickly a bad release would be spotted. The Primary Wire reported in October on a similar abuse of stolen credentials to push a poisoned release of the AI gateway LiteLLM, citing The Register.
OPSShield has not said where affected customers are located, and no U.S. victims have been confirmed.
What to Watch
OPSShield tells customers to install the cleaned-up release, which removes the known backdoor. Where the script may have run, it says to reset root and other local account passwords from a trusted recovery environment and to rotate database passwords, cloud keys and remote-login keys. “If cPGuard was not online during that window, your server did not receive the fake update,” the company said, as quoted by SecurityWeek. It is reissuing license keys and rebuilding its billing and licensing systems, but has not explained how the credentials were stolen.
