cPGuard update channel hijacked to deploy backdoors and steal password hashes

# cPGuard update channel hijacked to deploy backdoors and steal password hashes

https://gcdradar.vercel.app/incidents/cpguard-update-channel-hijacked-to-deploy-backdoors-and-stea · AIR-2026-1744 · live

- Lane: Supply chain
- Severity: 4 (Confirmed real-world loss): Confirmed real-world data theft via hijacked software update channel.
- Fix status: Patched
- First reported: 2026-11-03 (happened 2026-11-02)
- AI role: No AI role
- Products: cPGuard

## Summary

Attackers breached the update system of the cPGuard security tool on November 2 to distribute a malicious script to customer Linux servers. The script deployed a backdoor and exfiltrated sensitive files including password hashes.

## What to do

Update cPGuard to version 5.88.25 or later and inspect servers for compromise.

## Affected and fixed versions

- Affected: cPGuard < 5.88.25
- Fixed in: cPGuard 5.88.25

## Latest updates

- 2026-11-04: Attackers accessed OpsShield update servers using compromised credentials to poison multiple cPGuard versions (https://securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack)
- 2026-11-04: The poisoned cPGuard update affected nearly 3000 customer servers using versions 5.88.12 through 5.88.19 (https://helpnetsecurity.com/2026/11/04/cpguard-update-supply-chain-compromised)
- 2026-11-03: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data (https://bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data)
- 2026-11-03: cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html)

## Sources

- 2026-11-03 The Hacker News: cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html
- 2026-11-03 BleepingComputer: Hackers hijack cPGuard autoupdate to deploy backdoor, steal data https://bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data
- 2026-11-04 Help Net Security: Poisoned cPGuard update hits thousands of web hosting servers https://helpnetsecurity.com/2026/11/04/cpguard-update-supply-chain-compromised
- 2026-11-04 SecurityWeek: Malicious cPGuard Updates Served in OpsShield Supply Chain Attack https://securityweek.com/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.