Attackers hijack cPGuard's update channel and push a data-stealing script to about 2,950 hosting servers
OpsShield says compromised credentials let an attacker serve poisoned versions 5.88.12 through 5.88.19 of its Linux server security suite, which ran as root.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
OpsShield, an Indian security company, says an attacker used compromised credentials to get into the update distribution infrastructure for cPGuard, its security suite for Linux web hosting servers, on November 2. The attacker then pushed malicious updates labeled versions 5.88.12 through 5.88.19. Help Net Security reports the fake updates were uploaded between 02:04 and 02:09 UTC. For more than 70 minutes afterward, cPGuard agents installed them on about 2,950 customer servers and ran them as root. OpsShield says it detected the compromise and stopped distribution within 12 hours. Some servers may not have received the script, because update checks run at set intervals. The script collected password hashes, root SSH keys, MySQL root passwords where present, root shell history and cloud storage keys, then sent them out. It also left a hidden root shell behind. According to the company, the attackers first went after its billing and licensing server. They registered a customer account and ordered a free trial to study how cPGuard talks to the licensing system, then sent crafted requests that gave them command execution. Customer contact details and hashed passwords on that server were also stolen. cPGuard is commonly used alongside the cPanel, DirectAdmin and Plesk control panels, and Namecheap offers it on its VPS and dedicated servers. Hosting operators who updated during the window should treat their servers' credentials as exposed.