cPGuard Update Hijacked: Backdoor Pushed to Servers

Short answer: Attackers broke into the update system for cPGuard, a Linux web server security suite, and pushed a backdoor and a data-stealing script to customers. If you run cPGuard, update to version 5.88.25 or later, then change every password and key that was stored on that server. The update removes the backdoor, but it does not undo the theft.

The key facts

cPGuard is used alongside control panels such as cPanel, DirectAdmin and Plesk, and Namecheap offers it on VPS and dedicated servers. The vendor says it noticed the problem and stopped the bad updates within 12 hours. It could not confirm whether every server that checked for updates in that window ran the script, because update checks happen at set intervals.

What the script took

According to BleepingComputer, the script went after sensitive files on each server:

• Linux password hashes (scrambled versions of account passwords)
• the root database configuration for MariaDB or MySQL
• the root user's shell history
• the root SSH authorization and known-hosts files

The stolen data was uploaded through a compromised account on OpsShield's licensing server. The vendor says its billing system database was also copied. It has not yet worked out what was collected from each customer.

Step 1: check your version

Log in to the server and check the installed cPGuard version in its dashboard or command line tool. If it shows anything from 5.88.12 to 5.88.19, treat the server as compromised. If you updated on or after November 2 and are not sure of the version, check anyway.

Step 2: update to 5.88.25 or later

Update every cPGuard server, not just the ones you think were hit. OpsShield says the latest version removes the backdoor and the staged files. It also plans a further update that removes previously installed OpsShield support-access keys, so install that when it arrives.

Step 3: rotate everything that was on the server

This is the step that matters most. Per the vendor's advice, reset passwords and rotate:

1. database credentials, including the root MariaDB or MySQL account
2. cloud secrets and API keys kept on the server
3. SSH keys, and remove any you do not recognise from authorized_keys
4. control panel and hosting account passwords

Because password hashes were taken, assume weak passwords can be cracked. Use long, unique replacements. See weak admin passwords for what to avoid.

Step 4: review the server and your backups

Look for logins you do not recognise and for new files or scheduled tasks you did not create. The article lists no file names or other indicators, so check the OpsShield notice for updates. If you find anything odd, restore from a clean copy. A recent website backup makes that far easier.

Common mistakes

• Updating cPGuard and stopping there. The stolen credentials still work.
• Rotating the website password but not the root database and SSH keys.
• Assuming you are safe because you did not see an alert. The malicious script was quiet.
• Letting security tools auto-update on production servers with no monitoring of what changed.
• Waiting for the vendor's final report before rotating credentials.