# cPGuard update compromise exposes data from 2946 servers

_Published Tuesday, November 3, 2026 at 5:29 PM EST · Security, Infrastructure · Latest · Tier 1 — Major_

![cPGuard update compromise exposes data from 2946 servers — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/09/hacker-box.jpg)

Attackers compromised cPGuard's update infrastructure on November 2 at 02:06 UTC, distributing a backdoor and a script that stole server data, developer OpsShield said. A spokesperson told BleepingComputer that 2946 servers were affected and the company's billing database was also copied.

The attack used compromised credentials and affected versions 5.88.12 through 5.88.19. Targeted information included Linux password hashes, root database configuration, shell history and SSH files. OpsShield says it stopped malicious distribution within 12 hours. Administrators should update to version 5.88.25 or later and rotate exposed credentials; updating removes the backdoor but does not invalidate stolen secrets.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data/)

---
Canonical: https://techandbusiness.org/newswire/LN8cijbOkz-6l5ZCtAiUb-
Published: 2026-11-03T22:29:03.962Z
Story chronology: 2026-11-02T02:06:00.000Z
Retrieved: 2026-11-04T01:16:38.855Z
Publisher: Tech & Business (techandbusiness.org)