# Hijacked cPGuard updates backdoor Linux servers and expose credentials

_Published Tuesday, November 3, 2026 at 12:17 PM EST · Security · Latest · Tier 2 — Notable_

![Hijacked cPGuard updates backdoor Linux servers and expose credentials — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtc3HOtWwxZPk7V8yva9o6Oe5lWAPX8KZsWHG27ohycqrb04wAKSDSSdk6ta6y284N9gT6Ab6QKIWwTPss2bBK4PtS3Fm7gSI9QG5kec2AvEgQPjQnc0YlhlUQx0uZKt2ygn576BQ3aburL-IhrMRFVm1vEpTR5ol06R0BtjySvifD05Q_dQGUPvyPLxs/s1700-nu-rw-lo-l85-e365/cpgaurd.png)

An attacker compromised cPGuard's update system on November 2 and distributed a script that installed a backdoor and collected password hashes and sensitive files from customers' Linux servers, maker OPSSHIELD said. Versions 5.88.12 through 5.88.19 carried the malicious script after the attacker accessed the system with compromised credentials at 02:06 UTC.

Versions 5.88.25 and later remove the backdoor and files it left, but potentially exposed credentials still require replacement. OPSSHIELD estimated late on November 2 that the attacker had taken 32 files, each associated with one customer server. That count covers known data theft, not the total number of potentially affected servers.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html)

---
Canonical: https://techandbusiness.org/newswire/A5AX1iAjCPGDRu3AV2BC0r
Published: 2026-11-03T17:17:00.856Z
Story chronology: 2026-11-02T02:06:00.000Z
Retrieved: 2026-11-03T20:42:38.745Z
Publisher: Tech & Business (techandbusiness.org)