This is the nightmare scenario for anything that auto-updates. An attacker got into the update system of cPGuard, a Linux server security tool from OPSSHIELD, on November 2 and pushed a malicious script to customers.
What happened
- The attacker used compromised credentials to get into the update system and shipped the script in cPGuard 5.88.12 through 5.88.19.
- The script installed a backdoor and grabbed password hashes and other sensitive files. Some of that data has already been taken.
- It was caught within about 12 hours. Version 5.88.25 and later remove the backdoor and the files it left behind.
- OPSSHIELD hasn’t said how many servers got it or how the credentials leaked.
What to do
Check the install log: grep 'Successfully updated' /opt/cpguard/logs/install_log. If you see any version from 5.88.12 to 5.88.19, update to 5.88.25+ and then rotate every password and key on that box. The update cleans up the backdoor, but stolen credentials still work.
The bigger lesson: a security tool with root and an auto-update channel is a supply chain. Know which of your tools can push code to your servers on their own.
God Bless, and Needs Garlic!
