cPGuard update channel delivers root credential theft; later report expands scope
OPSSHIELD confirms a poisoned cPGuard update and later reports ~2,950 servers ran it and ~7,900 billing accounts were copied. Update to the latest release, replace root/cloud/database secrets and billing passwords, and check removed tasks. Earlier 32-file retrieval is not the total scope; investigation continues.
- Disclosed
- Nov 2, 2026
- Updated Nov 3, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- cPGuard online Nov 2, 02:08–03:20 UTC: assume root secrets exposed; billing-portal accounts are separately affected
- cPGuard · supply chain · credentials
- In the wild
- Yes
- OPSSHIELD confirms malicious updates, copied secrets and attacker data retrieval.
What happened
OPSSHIELD’s later November 3 report traces the incident to a newly registered customer account and billing/licensing-server command execution, then theft of update-storage keys. The exact successful request was not logged; two possible entry points were patched, but no CVE or proven upstream-component cause is published. About 2,950 update-execution servers and 7,900 billing-account records are vendor estimates, not independently audited unique people. Billing records include name, company, postal address, email and bcrypt password hashes. The earlier 32-file retrieval estimate measures a narrower observation and cannot cap the later scope or be added to it.
The first advisory’s timestamped November 3 IST updates fall on November 2 UTC (02:42 IST = 21:12 UTC; 03:17 IST = 21:47 UTC), which is the disclosure day used here. The later report says the poisoned-update installation window was 02:08–03:20 UTC on November 2 and asks online servers to assume root-secret exposure. An affected-version installation is not proof that every file was exfiltrated, and absent logs are not proof of safety. The vendor’s “short script” description does not negate its confirmed hidden root shell and scheduled task.
The earlier 5.88.25 cleanup/no-routine-rebuild advice is historical. The later report names 5.88.26 plus a further cron-removal update, asks for the latest version, and specifically requires a clean pre-November 1 backup rebuild if it notified you of manual attacker login. Cleanup cannot revoke copied secrets. Reissued license keys and reset billing sessions do not replace customer password, SSH, database and cloud-secret rotation. Vendor infrastructure rebuilding is separate from customer-host recovery. The vendor’s statement that its listed steps close exposure is not an independent assurance that a host is clean.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| cPGuard cleanup baseline; install latest follow-up too | 5.88.26 | Known-shell removal; follow-up cron cleanup also required |
Crime-scene timeline
Nov 1, 22:58 UTC
Attacker executes commands on billing/licensing server
The later report traces access through a newly registered customer account; the exact successful request was not logged.
Nov 2, 02:04–02:09 UTC
Stolen update key publishes the malicious package
The later report gives the upload window, refining the earlier advisory’s 02:06 UTC update-infrastructure access time.
Nov 2, 02:08–03:20 UTC
Customer agents install and run the fake update as root
OPSSHIELD says root-level secrets should be assumed exposed on cPGuard servers online during this window.
Nov 2, 21:12 UTC
Early advisory estimates 32 retrieved files
Original timestamp: November 3, 02:42 IST (UTC+05:30). Each file corresponds to a customer server; the vendor explicitly says this is not the full potentially affected population.
Nov 2, 21:47 UTC
Support-access key removal announced
Original timestamp: November 3, 03:17 IST. This precaution does not replace credential rotation.
Nov 3, 2026
Later disclosure expands server and billing-account scope
The company reports about 2,950 servers ran the update and about 7,900 billing accounts were copied; latest cleanup and conditional rebuild guidance supersede the earlier narrower assessment.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- OPSSHIELD original update-channel advisoryPrimaryFull public browser original read: affected 5.88.12–5.88.19; 5.88.25 cleanup, data collection/32-file retrieval, resets and timestamped IST updates. Superseded in scope by linked later report; HTTP fetch returned 406.
- OPSSHIELD later manage.opsshield.com incident disclosurePrimaryFull public browser report: UTC attack/update timeline, about 2,950 execution servers/about 7,900 copied accounts; 5.88.26 plus follow-up cleanup, full IoCs, license/session changes and conditional rebuild. Exact successful billing request absent from logs.