# cPGuard: malicious updates expose server credentials

Canonical: https://www.oktsec.com/radar/cpguard-update-channel-compromise-2026
Publisher: Oktsec
Language: en
Published: 2026-11-05T12:24:43Z
Updated: 2026-11-05T12:24:43Z
Record reviewed: 2026-11-05T12:24:43Z
Latest evidence check: 2026-11-05T12:24:43Z
Disclosed: 2026-11-03

OPSSHIELD confirms malicious cPGuard updates and exposure of server secrets. Its latest disclosure reports about 2,950 servers ran the update; this is the provider’s count.

## Evidence and response priority

- Category: Supply chain
- Oktsec priority: Act now
- Rationale: Exposed credentials can remain usable after cleanup. Prioritize affected servers and systems that trust their keys.
- Evidence: Attacks confirmed
- Verification: Vendor confirmed
- Fix status: Additional action required
- Exposure requirement: Affected package must execute
- Vendor: OPSSHIELD
- Products: cPGuard, OPSSHIELD billing portal

## Technical overview

OPSSHIELD says an attacker breached its billing and licensing system, stole an update key and distributed a malicious agent update that ran as root.

The earlier notice is explicitly superseded by the linked incident disclosure. Version 5.88.25 was its initial cleanup recommendation; it is not the complete recovery guidance now.

Update records identify potentially affected servers, not the exact data transferred from each. Investigate password hashes, database configuration and root shell history alongside SSH trust. A successful upgrade or absence of known files after cleanup cannot establish that previous credentials remained private.

Oktsec recommends coordinating server recovery with the owners of connected systems. Record which credentials were revoked and which dependencies have been checked before restoring sensitive access.

## Recommended response

Install the latest corrective update, rotate exposed credentials and revoke old SSH trust. Cleanup alone does not invalidate stolen secrets.

Relevant to: Hosting administrators and organizations using cPGuard.

## Affected systems and fixes

### cPGuard

Affected: Earlier notice: updates 5.88.12–5.88.19. Latest disclosure: servers online November 2, 02:08–03:20 UTC should assume root secrets exposed.

Fixed release / action: Latest corrective release, including 5.88.26 cleanup and the subsequent scheduled-task removal. Credential recovery remains necessary.

Confirm the running version against the vendor advisory, including any distribution backports.

## Response checklist

1. **Check update history** — Review /opt/cpguard/logs/install_log. Affected installation is not proof of individual data transfer; missing logs do not establish safety.
2. **Apply current cleanup guidance** — Update and confirm removal of /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh. Preserve evidence before cleanup.
3. **Rotate credentials and revoke trust** — Replace local passwords, root SSH keys, database credentials and exposed tokens. Remove old public keys from every trusting server. Reset the billing password and enable multifactor authentication.
4. **Escalate evidence of further access** — The latest notice requires a clean backup from before November 1 for customers notified of manual attacker access. Ask the provider for an individual assessment if integrity is uncertain.

## Relevance to AI environments

Include automation credentials stored on affected hosts in recovery.

## Sources

- [Latest incident disclosure and recovery guidance](https://opsshield.com/notice/security-incident-disclosure-servermanage.html) — OPSSHIELD; Vendor notice; checked 2026-11-05T12:14:16Z
- [Earlier advisory: affected updates and log limitations](https://opsshield.com/notice/cpguard-update-channel-compromise.html) — OPSSHIELD; Vendor notice; checked 2026-11-05T12:14:16Z

## Editorial record

- 2026-11-05T12:24:43Z: Added scope, evidence and response guidance from the official notices.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/cpguard-update-channel-compromise-2026) · [Build a response plan](https://www.oktsec.com/radar/cpguard-update-channel-compromise-2026#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cpguard-update-channel-compromise-2026&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=cpguard-update-channel-compromise-2026&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.