Hijacked cPGuard updates backdoor Linux servers and expose credentials

An attacker compromised cPGuard's update system on November 2 and distributed a script that installed a backdoor and collected password hashes and sensitive files from customers' Linux servers, maker OPSSHIELD said. Versions 5.88.12 through 5.88.19 carried the malicious script after the attacker accessed the system with compromised credentials at 02:06 UTC. Versions 5.88.25 and later remove the backdoor and files it left, but potentially exposed credentials still require replacement. OPSSHIELD estimated late on November 2 that the attacker had taken 32 files, each associated with one customer server. That count covers known data theft, not the total number of potentially affected servers.