[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (OPSSHIELD incident disclosure, Nov 3, published after our first item)

cPGuard update: OPSSHIELD says the attacker signed up for a free trial, took over its billing server and stole the update key; about 2,950 customer servers ran the fake update

  • If cPGuard was online 02:08–03:20 UTC Nov 2: update to the latest cPGuard (5.88.26 removes the hidden root shell). Confirm /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh are gone, then rotate root and local passwords, root SSH keys (and remove them from every authorized_keys that trusts them), MySQL root, anything in root's shell history and /root/.s3cfg.
  • Everyone: reset your manage.opsshield.com password and turn on 2FA.
  • OPSSHIELD says it can't see the exact request that gave the attacker access; it patched two possible entry points and is reviewing the code. It attributes the ~10-hour speed partly to AI tooling (its opinion, no evidence given).

Indicators are in the hunting item linked from our Threat Hunting section.

Sources: OPSSHIELD: Security Incident Disclosure: manage.opsshield.com (Nov 3) · OPSSHIELD: cPGuard update channel compromise advisory