OpsShield, the developer of the cPGuard security suite, suffered a security breach targeting its update distribution infrastructure, allowing attackers to deploy malware and steal sensitive data from thousands of servers. The breach occurred on November 2, 2026, and lasted for 12 hours before the company detected it and halted the unauthorized distribution.
Breach Details and Targeted Data
The attackers exploited compromised credentials to access OpsShield's content delivery network (CDN) update distribution infrastructure and injected a malicious script into cPGuard updates for versions 5.88.12 through 5.88.19. When server administrators updated the system during the breach window, the script executed and targeted the collection of sensitive information, including:
- Encrypted Linux passwords.
- MariaDB/MySQL root database configurations.
- Root shell command history.
- SSH keys and known-hosts authentication files.
The company confirmed that the attackers gained access to data from approximately 2,946 servers, in addition to copies of the company's billing system database.
What This Means for Users
This breach is severe due to the nature of the stolen data, which grants attackers full access to the affected servers. Because cPGuard is widely used by hosting companies and server administrators to protect platforms such as cPanel, DirectAdmin, and Plesk, the scope of impact extends across a broad digital infrastructure.
Required Actions
OpsShield recommends that all customers immediately take the following steps to ensure the security of their servers:
- Update cPGuard to version 5.88.25 or newer, as this update removes the malware and planted files.
- Reset all server passwords.
- Change database credentials and cloud secrets.
- Generate new SSH keys and revoke old keys that may have been leaked.
The company also plans to release an additional update to remove technical support access keys that may have been used by the attackers as an extra precautionary measure.