> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# cPGuard updates were hijacked to push a server backdoor
- URL: https://stackurity.ai/blog/cpguard-update-channel-hijacked-backdoor/
- Published: 2026-11-04T01:35:04.000Z
- Updated: 2026-11-04T01:35:04.000Z
- Description: The cPGuard update system was hijacked to send a backdoor to Linux servers. See what the maker says and how to scope your exposure.
- Author: Stackurity Research Team
- Tags: Linux Servers, News

**TL;DR:** Intruders took over how the cPGuard security tool delivers updates and pushed a malicious script to customers' Linux servers. There is no CVE to match here, so check whether you ran cPGuard and follow the maker's advisory.

## What happened

[The Hacker News reported](https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html) on November 3, 2026 that an intruder compromised the way cPGuard delivers updates on November 2\. According to an advisory from the maker, OPSSHIELD, the script left a backdoor behind and gathered password hashes along with other sensitive files. The report says the attacker has already taken some of the data.

## Am I affected?

Any server that runs cPGuard and pulled an update during the attack window may be affected. Read the OPSSHIELD advisory for the affected versions and its cleanup steps, because the article extract we reviewed does not settle them. Assume that password hashes on an exposed server may be stolen, and plan to rotate credentials as the advisory says.

## How to check with Stackurity

This is a compromised update channel, not a known vulnerability, so Stackurity's matching against advisories will not find the backdoor, and we will not claim otherwise. What the read-only agent does give you is a live inventory of installed software, which helps you list the servers that run a given tool when you need to scope an incident. Stackurity also does not cover libraries copied into an application outside a package manager, so confirm cPGuard installs by hand as well. See [how fixes are tracked](https://stackurity.ai/docs/remediation) in the docs. Stackurity Cloud has a 14-day free trial without a card: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=linux-servers&utm%5Fcontent=cpguard-update-channel-hijacked-backdoor).