{"id":3915,"date":"2026-11-04T06:49:05","date_gmt":"2026-11-04T14:49:05","guid":{"rendered":"https:\/\/cyber.mag212.com\/cpguard-update-channel-hijacked-linux-servers\/"},"modified":"2026-11-04T06:49:05","modified_gmt":"2026-11-04T14:49:05","slug":"cpguard-update-channel-hijacked-linux-servers","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/cpguard-update-channel-hijacked-linux-servers\/","title":{"rendered":"Canal de mise \u00e0 jour de cPGuard pirat\u00e9\u00a0: ce qui s\u2019ex\u00e9cutait sur 2\u00a0950 serveurs Linux et comment faire tourner chaque secret expos\u00e9"},"content":{"rendered":"<p class=\"wp-block-paragraph\">An attacker posing as a customer broke into OPSSHIELD&#8217;s billing and licensing server, took the key used to publish cPGuard updates, and shipped a fake update. On <strong>November 2, 2026, between 02:08 and 03:20 UTC<\/strong>, cPGuard agents on about <strong>2,950 Linux hosting servers<\/strong> installed it and ran it as root. The script copied root password hashes, SSH keys, MySQL credentials and shell history, and left a hidden root shell behind.<\/p>\n\n<p class=\"wp-block-paragraph\">cPGuard is a security suite for Linux web hosting servers. Updating it removes the attacker&#8217;s files, but it does not un-leak a private key. This guide covers what happened, how to tell whether your server ran the script, and how to rotate every secret it could have taken.<\/p>\n\n<h2 class=\"wp-block-heading\">Faits cl\u00e9s<\/h2>\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Article<\/th><th>D\u00e9tail<\/th><\/tr><\/thead><tbody><tr><td>Produit<\/td><td>cPGuard (OPSSHIELD), Linux hosting security suite<\/td><\/tr><tr><td>Poisoned builds<\/td><td>5.88.12 \u2013 5.88.19, per the vendor advisory and press reports<\/td><\/tr><tr><td>Install window<\/td><td>November 2, 2026, 02:08 \u2013 03:20 UTC<\/td><\/tr><tr><td>Servers affected<\/td><td>About 2,950 (one early count said 2,946)<\/td><\/tr><tr><td>Runs as<\/td><td>root<\/td><\/tr><tr><td>Also exposed<\/td><td>About 7,900 billing-portal records: name, company, address, email, bcrypt password hash<\/td><\/tr><tr><td>Clean build<\/td><td>5.88.26 per the incident disclosure (the earlier advisory said &#8220;5.88.25 or later&#8221;); use the latest<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<h2 class=\"wp-block-heading\">How the attack unfolded<\/h2>\n\n<p class=\"wp-block-paragraph\">OPSSHIELD&#8217;s incident disclosure lays out the timeline. On November 1 the attacker probed the billing portal, registered a customer account under a false identity, and installed a free trial to study how the agent talks to the licensing system. That evening, crafted requests to the portal&#8217;s callback pages gave the attacker command execution on the billing and licensing server. Early on November 2, using a stolen access key, the attacker uploaded fake update scripts to OPSSHIELD&#8217;s update storage. cPGuard agents that checked in during the next 70 minutes installed one.<\/p>\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1598\" height=\"745\" src=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-04-fig-cpg.jpg\" alt=\"Diagram of the cPGuard compromise: fake customer account, billing server takeover, stolen update key, fake update running as root on about 2,950 servers, and downstream secrets to rotate\" class=\"wp-image-3898\" srcset=\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-04-fig-cpg.jpg 1598w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-04-fig-cpg-300x140.jpg 300w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-04-fig-cpg-1024x477.jpg 1024w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-04-fig-cpg-768x358.jpg 768w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-04-fig-cpg-1536x716.jpg 1536w, https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-04-fig-cpg-18x8.jpg 18w\" sizes=\"auto, (max-width: 1598px) 100vw, 1598px\" \/><figcaption class=\"wp-element-caption\">Stages 1\u20132 follow OPSSHIELD\u2019s disclosure; stage 3 shows the downstream exposure MAG212 recommends assessing. Times UTC. MAG212 CYBER original diagram.<\/figcaption><\/figure>\n\n<h2 class=\"wp-block-heading\">What the fake update took<\/h2>\n\n<ul class=\"wp-block-list\"><li><code data-no-translation=\"\">\/etc\/shadow<\/code> et <code data-no-translation=\"\">\/etc\/passwd<\/code> (local password hashes)<\/li><li><code data-no-translation=\"\">\/root\/.ssh<\/code>: private keys, <code data-no-translation=\"\">authorized_keys<\/code> et <code data-no-translation=\"\">known_hosts<\/code><\/li><li><code data-no-translation=\"\">\/root\/.my.cnf<\/code>: the MySQL root password, where present<\/li><li>Root shell history, including anything typed on the command line<\/li><li><code data-no-translation=\"\">\/root\/.s3cfg<\/code> cloud storage keys, on a small number of servers<\/li><\/ul>\n\n<p class=\"wp-block-paragraph\">The script uploaded the data to OPSSHIELD&#8217;s own licensing server under a compromised account, for the attacker to collect later. It also left a setuid root shell and a cron task. OPSSHIELD describes it as a short script, not a long-term implant. It has not said how the update key was first obtained.<\/p>\n\n<h2 class=\"wp-block-heading\">Was my server affected?<\/h2>\n\n<p class=\"wp-block-paragraph\">If cPGuard was online and checked for updates between 02:08 and 03:20 UTC on November 2, OPSSHIELD says to assume the root-level secrets are known to the attacker. Agents poll at intervals, so some servers never received the script. The vendor also warns that a missing record in its lookup tool does not prove a server was safe.<\/p>\n\n<p class=\"wp-block-paragraph\">Check for the published artifacts. Preserve the output in your case notes, and never run anything you find:<\/p>\n\n<pre class=\"wp-block-code\" data-no-translation=\"\"><code data-no-translation=\"\">sudo stat \/etc\/cron.d\/i93677 \/var\/tmp\/.i93677 \/var\/tmp\/.cpg91511_sh\nsudo find \/ -xdev -name 'cpguard-v58812-i91511*.sh' -exec sha256sum {} + 2&gt;\/dev\/null\nsudo find \/var\/tmp \/tmp -xdev -perm -4000 -type f -ls   # unexpected setuid files\nsudo last -Fai | head -40                                # recent logins with IPs<\/code><\/pre>\n\n<p class=\"wp-block-paragraph\">A &#8220;No such file&#8221; result is not proof of safety: the clean update removes these files. Also check network and authentication logs for the attacker addresses OPSSHIELD published (<code data-no-translation=\"\">94.183.188.91<\/code>, <code data-no-translation=\"\">5.182.208.167<\/code>, <code data-no-translation=\"\">5.182.208.206<\/code>) and the fake user agent <code data-no-translation=\"\">cPGuard\/5.88.11<\/code>. The vendor publishes SHA-256 hashes for the four fake update scripts. Copy them from its disclosure before you build detections.<\/p>\n\n<h2 class=\"wp-block-heading\">How to recover, in order<\/h2>\n\n<ol class=\"wp-block-list\"><li><strong>Scope.<\/strong> Record whether the server was online during the window, and convert all timestamps to UTC in your notes.<\/li><li><strong>Preserve.<\/strong> Capture artifact metadata, hashes and auth logs before cleanup.<\/li><li><strong>Update.<\/strong> Upgrade through the vendor channel to the latest build. 5.88.26 removes the hidden root shell, and a follow-up removes the <code data-no-translation=\"\">i93677<\/code> cron task. Confirm the artifacts are gone.<\/li><li><strong>Rotate.<\/strong> Change root and local passwords. Generate new root SSH keys and remove the old public key from <em>every<\/em> server that trusted it. Change the MySQL root password and the credentials in <code data-no-translation=\"\">\/root\/.my.cnf<\/code>. Rotate anything typed into shell history and the keys in <code data-no-translation=\"\">.s3cfg<\/code>.<\/li><li><strong>Rebuild if needed.<\/strong> OPSSHIELD does not advise a routine OS rebuild. It does advise restoring from a clean backup taken before November 1 if the attacker logged in to a server manually.<\/li><li><strong>Account hygiene.<\/strong> Reset the billing-portal password, turn on two-factor login, and expect targeted phishing that uses the leaked billing data.<\/li><\/ol>\n\n<h2 class=\"wp-block-heading\">Credential rotation worksheet<\/h2>\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Exposed item<\/th><th>Where it is trusted<\/th><th>Proof it is closed<\/th><\/tr><\/thead><tbody><tr><td>Root &#038; local passwords<\/td><td>Console, sudo, any reuse elsewhere<\/td><td>Old hashes gone; no reuse found<\/td><\/tr><tr><td>Root SSH private key<\/td><td>Every authorized_keys holding its public key<\/td><td>Old key refused on all hosts<\/td><\/tr><tr><td>MySQL root \/ .my.cnf<\/td><td>Databases, backups, monitoring<\/td><td>Old credentials fail; apps healthy<\/td><\/tr><tr><td>Cloud keys (.s3cfg, history)<\/td><td>Buckets and provider APIs<\/td><td>No use of old key IDs in audit logs<\/td><\/tr><tr><td>Billing-portal login<\/td><td>OPSSHIELD account<\/td><td>Sessions reset; 2FA on<\/td><\/tr><\/tbody><\/table><\/figure>\n\n<p class=\"wp-block-paragraph\"><em>Commands were checked against documentation but not run against live systems for this article. Use them only on servers you are authorized to manage.<\/em><\/p>\n\n<h2 class=\"wp-block-heading\">Foire aux questions<\/h2>\n\n<h3 class=\"wp-block-heading\">Is updating cPGuard enough?<\/h3>\n\n<p class=\"wp-block-paragraph\">No. Updating removes the attacker&#8217;s files, but passwords and keys the script copied stay valid until you change them, both on this server and on every system that trusts them.<\/p>\n\n<h3 class=\"wp-block-heading\">Should I rebuild my server?<\/h3>\n\n<p class=\"wp-block-paragraph\">OPSSHIELD does not recommend it as a routine step. Rebuild from a clean, pre-November 1 backup if there is evidence the attacker logged in manually, or if you cannot establish the host&#8217;s integrity.<\/p>\n\n<h3 class=\"wp-block-heading\">Did the attacker use the stolen secrets?<\/h3>\n\n<p class=\"wp-block-paragraph\">That is not established. The disclosure confirms the script ran and collected files; whether stolen credentials were later used against a given customer is unknown. Check your own authentication logs.<\/p>\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-fe48e5de wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/fr\/when-the-update-becomes-the-attack-mag212-cyber-daily-november-4-2026\/\">Read today&#8217;s full MAG212 CYBER Daily (free) \u2192<\/a><\/div><div class=\"wp-block-button is-style-outline is-style-outline--1\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/cyber.mag212.com\/fr\/subscribe-free\/\">Abonnez-vous gratuitement<\/a><\/div><\/div>\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/opsshield.com\/notice\/security-incident-disclosure-servermanage.html\" target=\"_blank\" rel=\"noreferrer noopener\">OPSSHIELD: Security Incident Disclosure (Nov 3, 2026)<\/a><\/li><li><a href=\"https:\/\/opsshield.com\/notice\/cpguard-update-channel-compromise.html\" target=\"_blank\" rel=\"noreferrer noopener\">OPSSHIELD: cPGuard security advisory, update channel compromise<\/a><\/li><li><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data\/\" target=\"_blank\" rel=\"noreferrer noopener\">BleepingComputer: Hackers hijack cPGuard autoupdate<\/a><\/li><li><a href=\"https:\/\/www.securityweek.com\/malicious-cpguard-updates-served-in-opsshield-supply-chain-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">SecurityWeek: Malicious cPGuard updates served in OpsShield supply chain attack<\/a><\/li><li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/11\/04\/cpguard-update-supply-chain-compromised\/\" target=\"_blank\" rel=\"noreferrer noopener\">Help Net Security: Poisoned cPGuard update hits thousands of servers<\/a><\/li><\/ul>\n\n<h2 class=\"wp-block-heading\">Articles connexes sur MAG212 CYBER<\/h2>\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/cyber.mag212.com\/fr\/when-the-update-becomes-the-attack-mag212-cyber-daily-november-4-2026\/\">When the Update Becomes the Attack: MAG212 CYBER Daily, 4 November 2026<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/cve-2026-119977-wordpress-core-update-race-cisa-kev\/\">CVE-2026-119977: The WordPress Core Update Race in CISA KEV<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/apt29-watering-hole-outdated-iphone-android-exploits\/\">APT29 Watering Holes Target Outdated Phones<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/3am-ransomware-uk-school-veeam-domain-trusts\/\">3AM Ransomware at a UK School Estate<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/synology-c3rb3r-ransomware-dsm-builds\/\">Synology C3RB3R Ransomware: Safe DSM Builds<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/drupal-commerce-core-cve-2026-118539-exploited\/\">Drupal Commerce Core CVE-2026-118539 Exploited<\/a><\/li><li><a href=\"https:\/\/cyber.mag212.com\/fr\/magazine-library\/\">Chaque num\u00e9ro de la biblioth\u00e8que de magazines<\/a><\/li><\/ul>","protected":false},"excerpt":{"rendered":"<p>A fake cPGuard update ran as root on about 2,950 Linux hosting servers on November 2, copying password hashes, SSH keys and MySQL credentials. Here is the timeline, how to check your server, and how to rotate every secret it touched.<\/p>","protected":false},"author":1,"featured_media":3910,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,15],"tags":[176,31,160,56],"class_list":["post-3915","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-incidents","category-threat-intelligence","tag-cpguard","tag-incident-response","tag-linux","tag-supply-chain-attack"],"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3915","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3915"}],"version-history":[{"count":0,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/posts\/3915\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media\/3910"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3915"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/categories?post=3915"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/tags?post=3915"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}