An unidentified attacker used stolen credentials on November 2 to get into the update system of cPGuard, a security tool for Linux servers made by OPSSHIELD, and pushed a malicious script in versions 5.88.12 through 5.88.19. According to the company, the script installed a backdoor and collected sensitive files, including the system password files, root's database configuration, shell history and SSH keys. The attack was detected within 12 hours.
The collected data was uploaded to a licensing server run by OPSSHIELD itself through a compromised account, and the attacker took 32 files from it, each tied to one customer server. The company stresses that the count may change and does not show how many servers are affected. It has replaced its infrastructure credentials, secured the account and is still investigating how the credentials were obtained.
What to do: update to cPGuard 5.88.25 or later, which removes the backdoor and the files the script left, and check the update log for any of the affected versions. A server that installed one should be treated as compromised: replace all passwords, SSH keys and secrets stored on it, even after updating. Admins who are unsure can contact OPSSHIELD support.