Hackers hijack cPGuard updates to hit 2,946 servers
Attackers used stolen credentials to push a backdoor and a data-stealing script through the update channel of the cPGuard web security suite, according to BleepingComputer.
The facts
- According to BleepingComputer, OpsShield says the attack began on 2 November at 02:06 UTC and hit cPGuard versions 5.88.12 through 5.88.19. The attacker used compromised credentials to reach its update distribution network.
- OpsShield says it stopped the malicious distribution within 12 hours. It is still unclear how the credentials were obtained.
- A company spokesperson told BleepingComputer that 2946 servers were affected and its billing system database was copied too. The investigation shows 32 files were retrieved from each customer.
- Admins are told to update to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets and SSH keys. Updating removes the backdoor, but stolen credentials must be invalidated separately.
Case notes · Danny's take
Why it matters
The tool meant to protect your server was the way in. That is the nature of a supply-chain attack: you did the right thing by updating, and that was the exposure. Hosting firms and server admins trust update channels by default, and attackers know it. Updating clears the malware. It does not un-steal your passwords.
For traders
If you run exchange infrastructure, a node or a wallet backend on a Linux host using cPGuard, treat any exposed keys as burnt, not merely at risk. Watch for unexpected withdrawals or logins from SSH keys and cloud secrets on affected machines.
For builders
Update to 5.88.25 or later, then rotate every secret that lived on the server: database logins, cloud keys and SSH keys. Longer term, pin or verify updates where you can, and keep secrets off boxes that auto-pull code from a third party.
Not financial advice. Do your own investigation.
This story was summarised with AI from BleepingComputer's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.