The cPGuard web security suite update infrastructure was compromised by attackers to distribute a backdoor and data-stealing script, as first reported by Bleeping Computer.
OpsShield, the developer of cPGuard, reported that an unidentified attacker used stolen credentials to access its content delivery network on Nov. 2 at 2:06 a.m. UTC. The breach affected versions 5.88.12 through 5.88.19 of the security suite. During the 12-hour window of the compromise, the malicious script targeted sensitive information, including Linux password hashes, root database configurations, shell history, and SSH keys. Approximately 2,946 servers were impacted by the incident, which also resulted in the unauthorized copying of the company's billing system database.
The attacker exfiltrated 32 files from each affected customer. System administrators are urged to update to cPGuard version 5.88.25 or later immediately. Furthermore, the vendor advises users to rotate all database credentials, cloud secrets, and SSH keys to mitigate potential unauthorized access. OpsShield is currently working to block malicious access and rebuild affected systems. This incident highlights significant risks for hosting firms and administrators relying on third-party security tools for server protection.
Source: Bleeping Computer
