cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes

An attacker compromised the update distribution system of cPGuard, a Linux server security tool developed by OPSSHIELD, on November 2. The attacker used the hijacked update channel to push a malicious script to customer Linux servers. The script deployed a backdoor and harvested password hashes along with other sensitive files. OPSSHIELD confirmed that the attacker has already exfiltrated some of the collected data. Affected versions include cPGuard 5.88.25 and later. This is a supply chain attack targeting the software update mechanism of a widely used security product. Server administrators using affected versions should treat their systems as compromised and rotate credentials immediately.