OPSSHIELD's cPGuard security tool was compromised on November 2, 2026, when an attacker breached the update distribution system. The malicious script was pushed to customers' Linux servers, where it installed a backdoor and collected password hashes and other sensitive files. The attacker subsequently exfiltrated some of the harvested data. The vendor has released version 5.88.25 and later to address the issue.

What should defenders do?

Update cPGuard to version 5.88.25 or later immediately. Verify the integrity of all future updates through official channels. Monitor server logs for unusual outbound connections or unauthorized process execution. Consider reviewing credential material stored on affected systems.

highmalware

cPGuard Update Channel Hijacked in Supply Chain Attack Targeting Linux Servers

Malicious script distributed via compromised update mechanism installs backdoor and exfiltrates password hashes

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago1 min read

cPGuard Update Channel Hijacked in Supply Chain Attack Targeting Linux Servers

Key Takeaways

The cPGuard update channel was compromised on November 2, 2026, in a supply chain attack.
A malicious script was pushed to Linux servers, installing a backdoor and harvesting password hashes.
The attacker exfiltrated some of the harvested data following the breach.
cPGuard 5.88.25 and later versions likely contain fixes; immediate updating is recommended.

Related Security News

highmalware

Google Warns of LLMjacking Campaigns Costing Enterprises Up to $1 Million in Fraudulent Cloud Charges

Google Cloud Security Team has issued a warning about LLMjacking, a threat actor technique involving the theft of Large Language Model API keys. Attackers obtain credentials through phishing, source code leaks, misconfigured environments, or exposed client-side code, then use the victim's cloud account to run expensive LLM computing workloads. The result is fraudulent cloud charges of up to $1 million per enterprise. Google recommends rotating compromised keys, implementing strict IAM policies, and monitoring for unusual LLM usage patterns.

The Hacker News16 minutes ago1 min read