cPGuard ran as root. 5.88.26 is not the hashes.

OPSSHIELD confirmed a 70-minute poisoned update on 2 November. About 2,950 Linux hosting servers executed it. The clean agent removes the shell. It does not change /etc/shadow.

RWP Ventures · 2026-11-05 · event 2026-11-02 · 14 min read · priority 9.0

Do not collapse five facts.

1. The overnight increment is the vendor’s public incident, not a CVE. There is no CVE ID and no KEV row. Live CISA catalog this run is 2026.11.04 / 1768, dateReleased 2026-11-04T20:00:05Z. The one new KEV row is CVE-2024-27834 (Apple WebKit Pointer Authentication bypass, patched May 2024, forensic triage No, due 18 November). That is a two-year-old PAC bypass that already requires arbitrary read/write. It is not 2,950 hosting servers that just ran a hostile update as root.
2. The clean agent is not the close. OPSSHIELD: if any Successfully updated line in /opt/cpguard/logs/install_log shows 5.88.12–5.88.19, treat the server as potentially compromised even if it now runs 5.88.25 or later. Absence of /var/tmp/.cpg91511_sh after cleanup does not establish whether the script previously ran.
3. Two different copies happened. On customer servers the script targeted /etc/shadow, /etc/passwd, root my.cnf, root shell history, and root SSH files. On OPSSHIELD’s side the attacker copied about 7,900 billing-portal accounts (name, company, postal address, email, bcrypt-hashed password) and, in a 3 November investigation update, OPSSHIELD estimates the attacker retrieved 32 collected files from its licensing server — one per customer server in that retrieved set, not the 2,950 that ran the update. Do not upgrade 32 into 2,950, or 2,950 into a named tenant census.
4. This is not Gheist and not LiteLLM. [Gheist](/posts/2026-10-26-gheist-github-sync-check/) planted GitHub Actions. [LiteLLM 1.107.0](/posts/2026-10-25-litellm-11070-cook-pth/) was a poisoned Python wheel. This is a signed-looking product update on Linux web-hosting boxes, running as root, with the loot channel being OPSSHIELD’s own licensing server. Same class (trusted updater), different vendor, different payload, different blast radius.
5. This is not yesterday’s WordPress race, and it is not a PLC. [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/) is still due tomorrow, 6 November, forensic triage Yes. Sites on those ~2,950 hosts may also be WordPress. Do not close a WordPress hunt on a cPGuard version string, or a cPGuard hunt on wp-includes/version.php. No OT/ICS process impact is in the vendor record.

The operator sentence: if a Linux host ran cPGuard and was online between 02:08 and 03:20 UTC on 2 November, assume root-level secrets left. Confirm 5.88.26 or later, then rotate every local password, SSH key, database password, and token that lived on that box. A clean cpgcli --version is not a rotation.

What happened

OPSSHIELD makes cPGuard, a malware scanner / WAF / firewall suite aimed at Linux web-hosting servers. Two vendor notices on 3 November are the primary record: a product advisory for the update channel, and an incident disclosure for manage.opsshield.com.

The attacker’s path, as OPSSHIELD reconstructed it (all times UTC):

OPSSHIELD has not named the exact request that produced command execution on the billing server. It says it ruled out SSH, the control panel, FTP, and API tokens, patched two possible entry points, and is still reviewing vendor components. Do not invent a CVE for that gap.

Help Net Security (4 November) and SecurityWeek (4 November) independently paraphrase the same two notices. They add no second victim census.

CISA’s 4 November KEV alert is one row, Apple CVE-2024-27834. It does not mention cPGuard.

Why it matters

Three operational reasons this is the daily.

First: the updater is the implant. cPGuard is the box that is supposed to catch malware on a hosting node. For about 70 minutes it was the malware, running as root, on every agent that polled in the window. Shared hosting means the blast is not “one company’s laptop.” It is every site whose database password, SSH hop, or panel credential lived on that node.

Second: the cleanup OPSSHIELD shipped is file removal, not secret invalidation. 5.88.25/5.88.26 delete the known setuid shell and staged archive. Follow-up work removes /etc/cron.d/i93677. Stolen /etc/shadow hashes, root SSH private keys, and MySQL root passwords remain valid until an administrator changes them. OPSSHIELD’s own provisional guidance: it is not recommending a routine OS rebuild. That is a vendor assessment, not a hunt finding. If OPSSHIELD told a customer the attacker logged in by hand, the same notice says rebuild from a backup taken before 1 November.

Third: the exfil path was the vendor. Collected files went to OPSSHIELD’s licensing server under a compromised account. Network controls that “only talk to the vendor” did not help. Detection is the install log, the leftover paths, and whether secrets still work — not an odd ASN on egress.

Who / what is affected

Confirmed in scope (OPSSHIELD primaries):

• cPGuard 5.88.12 through 5.88.19, served 2 November 2026.
• Linux hosting servers whose agents were online and checked for updates between 02:08 and 03:20 UTC that day. OPSSHIELD: about 2,950 ran the fake update.
• Billing-portal accounts at manage.opsshield.com: about 7,900 records copied (bcrypt-hashed passwords, not plaintext).
• Data the script was written to collect on customer servers: /etc/shadow and /etc/passwd; root MariaDB/MySQL my.cnf; root shell history; root SSH authorized_keys / known_hosts (incident disclosure also names /root/.ssh private keys); /root/.s3cfg on a small number of servers.

Confirmed not a substitute for rotation:

• Reaching 5.88.25, 5.88.26, or later. That removes known backdoor files. It does not rotate secrets.
• “No matching install_log lines.” OPSSHIELD: a missing or incomplete log does not by itself establish the server was unaffected.
• Resetting only the manage.opsshield.com password. Necessary. Not the host.

Confirmed not this incident:

• [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/) WordPress Core upgrade-window TOCTOU. Due 6 November. Different product.
• CVE-2024-27834 Apple WebKit PAC bypass. KEV 4 November. Different product, 2024 patch.
• JVN#12040144 / GHSA-g35w-6r6v-h4r7 Airbyte Connector Builder RCE. JPCERT/CC confirmed exploitation 4 November. Self-managed Airbyte before 2.2.0. Cloud customers need no action. Different product.
• ICSA-26-307-01 Subnet PowerSYSTEM Center. Not remote, no exploitation reported.
• [Gheist](/posts/2026-10-26-gheist-github-sync-check/) and [LiteLLM](/posts/2026-10-25-litellm-11070-cook-pth/). Same class, not this updater.

UNKNOWN / not validated:

• Attacker identity. OPSSHIELD: unidentified.
• How the update-storage key was obtained, beyond “stolen access key” after billing-server access.
• Per-server file list. OPSSHIELD: the listed files are the types collected; not every file from every server.
• How many of the ~2,950 had data retrieved by the attacker. Confirmed retrieval estimate is 32 files.
• Whether the gsocket backdoor (/usr/bin/defunct) and Go implant (/usr/sbin/pythno3, process shown as [rcu_gp]) listed in OPSSHIELD’s IoC table landed on customer servers. The vendor says those last rows come from its own internal server.
• Ransomware use. No claim in the notices.
• OT/ICS process impact. None reported. Hosting servers are IT.

Technical context

High level. This is not a how-to.

cPGuard agents periodically pull updates. For ~70 minutes on 2 November the object they pulled was attacker-controlled. OPSSHIELD describes the payload as a short script, not a long-term implant: collect, archive, upload, leave a hidden root shell and a scheduled task.

Hunt seeds from the vendor (not a closed set, not a PoC):

OPSSHIELD separately lists implants found on its internal server (defunct.service, /etc/profile.d/gateway.sh hiding ps/netstat/ls/find). Treat those as vendor-infrastructure IoCs unless you have independent evidence they were pushed to customers. Because those implants hide from standard tools, OPSSHIELD says check from a trusted boot environment or a known-good static binary — on their box, not as a default customer rebuild order.

ATT&CK mapping (assessed from the vendor record, not a CISA assignment): T1195.002 Compromise Software Supply Chain; T1078.003 Local Accounts (root); T1552.001 / T1552.004 Credentials in Files / Private Keys; T1053.003 Cron; T1036 masquerading as a product update. T1588.002 (tooling) is not evidenced beyond OPSSHIELD’s own comment that attackers now use AI to move faster; that sentence is vendor color, not a finding.

Threat / exploitation status

What defenders should do

1. Inventory cPGuard, not the ticket. On every Linux host that ever ran it: grep 'Successfully updated' /opt/cpguard/logs/install_log and cpgcli --version. Any 5.88.12–5.88.19 line is in scope even if the current string is 5.88.26.
2. Update, then prove the leftovers are gone. cpgcli update --start. Confirm 5.88.26 or later. Then confirm /etc/cron.d/i93677, /var/tmp/.i93677/, /var/tmp/.cpg91511_sh, and /var/tmp/.cpg91511/ are absent; delete them if not. Absence after cleanup is not a negative on prior execution.
3. Rotate from a trusted path. Reset root and every password-enabled local account. Replace root SSH key pairs and remove the old public keys from every system that trusted them. Change MySQL/MariaDB root and any password in /root/.my.cnf. Rotate tokens in root history and /root/.s3cfg. Treat lateral SSH from this host as exposed until those keys are dead.
4. Reset the billing portal. New manage.opsshield.com password, 2FA on. OPSSHIELD is re-issuing license key pairs; expect agents to re-license. Do not skip the host rotation because the portal was reset.
5. Hunt the hosting tenants. Sites on an affected node may have had database passwords in my.cnf or panel configs. That is a customer-notification and credential-rotation problem for the host, not a WordPress Core bump. Keep [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/) on its own ticket: due tomorrow.
6. Rebuild only where the vendor said someone logged in by hand, from a backup taken before 1 November, or where you cannot establish integrity. OPSSHIELD’s current default is not a fleet rebuild. If you find extra users, extra keys, extra services, or outbound you did not design, stop treating it as “update and rotate.”
7. Keep the Apple KEV and the Airbyte JVN on separate queues. CVE-2024-27834 due 18 November, forensic triage No, already patched in Safari 17.5 / iOS 17.5 / macOS 14.5 (May 2024). Airbyte self-managed before 2.2.0: JPCERT/CC says exploitation confirmed; Cloud is out of scope; 1.x has no fix. Neither is this updater.

RWP assessment

This is the daily because it is the largest confirmed, vendor-primary compromise in the window, it runs as root on hosting servers, and the operator error it invites — “we updated cPGuard” — leaves every copied secret live. Evidence quality is high on the update window, the version range, the ~2,950 execution count, the ~7,900 billing copy, the file types, and the cleanup builds (two OPSSHIELD notices, same-day). Evidence quality is moderate on how many of those 2,950 had data retrieved (32 is a preliminary pickup count). Evidence quality is low on attribution, the billing RCE primitive, and whether vendor-internal implants replicated to customers. We are not putting this on KEV, not inventing a CVE, not folding it into yesterday’s WordPress race, not treating Apple’s 2024 PAC bypass as the more urgent estate, and not calling OT impact.

Score 9.0. It outranks CISA’s 4 November KEV add of CVE-2024-27834 (real catalog increment, low operational urgency: 2024 patch, PAC bypass after existing R/W, forensic triage No, due 18 Nov), JVN#12040144 Airbyte (JPCERT/CC exploitation confirmed 4 Nov, CVSS 9.9, Cloud out of scope, no CVE, smaller confirmed blast), repeating WordPress 119977 (yesterday’s daily; clock hits tomorrow, no new catalog fact), Subnet PowerSYSTEM Center ICSA-26-307-01 (adjacent, no exploitation), and remaining Ivanti 118527 / Brotli / Adobe Commerce due-date clocks.

What we are watching

• Whether OPSSHIELD revises 2,950 / 7,900 / 32, names a billing-server CVE, or moves off “no routine rebuild.”
• Whether a hoster, CERT, or IR firm reports customer-server implants beyond the documented shell and cron.
• Whether ransomware use appears on any of those hosts.
• FCEB clock tomorrow, 6 November: [CVE-2026-119977](/posts/2026-11-04-wordpress-cve-2026-119977-kev/) WordPress Core. Brotli CVE-2026-111497 and Adobe Commerce CVE-2026-48356 due 10 November. VMware ESX CVE-2026-41709 due 11 November. Ivanti CVE-2026-118527 due 13 November. Apple CVE-2024-27834 due 18 November.
• Catalog increment past 2026.11.04 / 1768.
• Whether JVN#12040144 / GHSA-g35w-6r6v-h4r7 gets a CVE and a KEV row.

Sources

• OPSSHIELD — cPGuard security advisory: Update channel compromise, 3 November 2026
• OPSSHIELD — Security Incident Disclosure: manage.opsshield.com, 3 November 2026
• Help Net Security — Poisoned cPGuard update hits thousands of web hosting servers, 4 November 2026
• SecurityWeek — Malicious cPGuard Updates Served in OpsShield Supply Chain Attack, 4 November 2026
• CISA — Adds One Known Exploited Vulnerability to Catalog, 4 November 2026
• CISA — KEV JSON feed
• Apple — About the security content of iOS 17.5 and iPadOS 17.5
• NVD — CVE-2024-27834
• JPCERT/CC — JVN#12040144 Airbyte
• Airbyte — GHSA-g35w-6r6v-h4r7
• CISA — ICSA-26-307-01 Subnet Solutions PowerSYSTEM Center
• [RWP — WordPress CVE-2026-119977 KEV, 4 November 2026](/posts/2026-11-04-wordpress-cve-2026-119977-kev/)
• [RWP — Gheist, 26 October 2026](/posts/2026-10-26-gheist-github-sync-check/)
• [RWP — LiteLLM, 25 October 2026](/posts/2026-10-25-litellm-11070-cook-pth/)