cPGuard updates were hijacked to push a server backdoor
The cPGuard update system was hijacked to send a backdoor to Linux servers. See what the maker says and how to scope your exposure.
TL;DR: Intruders took over how the cPGuard security tool delivers updates and pushed a malicious script to customers' Linux servers. There is no CVE to match here, so check whether you ran cPGuard and follow the maker's advisory.
What happened
The Hacker News reported on November 3, 2026 that an intruder compromised the way cPGuard delivers updates on November 2. According to an advisory from the maker, OPSSHIELD, the script left a backdoor behind and gathered password hashes along with other sensitive files. The report says the attacker has already taken some of the data.
Am I affected?
Any server that runs cPGuard and pulled an update during the attack window may be affected. Read the OPSSHIELD advisory for the affected versions and its cleanup steps, because the article extract we reviewed does not settle them. Assume that password hashes on an exposed server may be stolen, and plan to rotate credentials as the advisory says.
How to check with Stackurity
This is a compromised update channel, not a known vulnerability, so Stackurity's matching against advisories will not find the backdoor, and we will not claim otherwise. What the read-only agent does give you is a live inventory of installed software, which helps you list the servers that run a given tool when you need to scope an incident. Stackurity also does not cover libraries copied into an application outside a package manager, so confirm cPGuard installs by hand as well. See how fixes are tracked in the docs. Stackurity Cloud has a 14-day free trial without a card: start a free trial.
