During a 70-minute stretch on November 2, roughly 2,950 Linux web hosting servers pulled a forged cPGuard release from their own vendor and executed it with root rights. OPSShield, the Indian company that builds the hosting security suite, has confirmed the intrusion and says billing data went with it.
The forged builds carried numbers 5.88.12 through 5.88.19 and sat in OPSShield’s update storage from 02:04 to 02:09 UTC. Every agent whose scheduled check fell inside that gap installed the code, and nothing in the signing or validation chain raised an alarm.
Preparation had begun a day earlier. An attacker created a billing portal account with fabricated details, took out a free cPGuard trial, and watched how the agent communicates with the licensing service. Requests crafted against the portal’s callback pages then yielded command execution on the very server that issues licenses, plus the storage key needed to publish updates.
The theft reached well past the host itself. Password hashes and private root SSH keys were taken, along with cloud storage keys, MySQL root credentials wherever a database was installed, and shell command history that can hold typed tokens. Persistence came in two parts: a hidden root shell at /var/tmp/.cpg91511_sh and helper files under /var/tmp/.i93677/. Roughly 7,900 customer records, including names, postal addresses, and bcrypt hashes, were also lifted.
OPSShield has since reissued license key pairs, rotated server credentials, and shipped version 5.88.26 to strip the hidden shell, with a follow-up build that deletes the i93677 scheduled task.
Hosting operators that ran cPGuard inside that window should assume every secret reachable as root is compromised. Hunt both temp paths first, then rotate database, SSH, and API credentials, and check for accounts or keys nobody remembers creating.
