---
title: cPGuard update: OPSSHIELD says the attacker signed up for a free trial, took over its billing server and stole the update key; about 2,950 customer servers ran the fake update | ctxsec
url: https://ctxsec.com/items/opsshield-cpguard-root-cause-fake-trial-billing-server-2950-servers
description: "OPSSHIELD's full disclosure greatly expands its first estimate of 32 affected servers. An attacker registered a customer account under a false identity on Nov 1, ordered a free cPGuard trial, studied the agent, and then sent crafted requests to callback pages on the billing portal (manage.opsshield.com) to get command execution on the billing and licensing server. From there they took an update-storage key and pushed fake cPGuard updates, which about 2,950 servers installed between 02:08 and 03:20 UTC on Nov 2. Those servers' password hashes, root SSH keys, MySQL root passwords and shell history should be treated as stolen. Records for about 7,900 billing accounts (name, company, address, email, bcrypt password hash) were also copied. OPSSHIELD is reissuing all cPGuard license keys."
status: "official (OPSSHIELD incident disclosure, Nov 3, published after our first item)"
published: 2026-11-04
---

> OPSSHIELD's full disclosure greatly expands its first estimate of 32 affected servers. An attacker registered a customer account under a false identity on Nov 1, ordered a free cPGuard trial, studied the agent, and then sent crafted requests to callback pages on the billing portal (manage.opsshield.com) to get command execution on the billing and licensing server. From there they took an update-storage key and pushed fake cPGuard updates, which about 2,950 servers installed between 02:08 and 03:20 UTC on Nov 2. Those servers' password hashes, root SSH keys, MySQL root passwords and shell history should be treated as stolen. Records for about 7,900 billing accounts (name, company, address, email, bcrypt password hash) were also copied. OPSSHIELD is reissuing all cPGuard license keys.

[← Cybersecurity News](/news) · [markdown](/items/opsshield-cpguard-root-cause-fake-trial-billing-server-2950-servers.md)

official (OPSSHIELD incident disclosure, Nov 3, published after our first item)

2026-11-04

### cPGuard update: OPSSHIELD says the attacker signed up for a free trial, took over its billing server and stole the update key; about 2,950 customer servers ran the fake update

- **If cPGuard was online 02:08–03:20 UTC Nov 2:** update to the latest cPGuard (5.88.26 removes the hidden root shell). Confirm `/etc/cron.d/i93677`, `/var/tmp/.i93677/` and `/var/tmp/.cpg91511_sh` are gone, then rotate root and local passwords, root SSH keys (and remove them from every `authorized_keys` that trusts them), MySQL root, anything in root's shell history and `/root/.s3cfg`.
- **Everyone:** reset your manage.opsshield.com password and turn on 2FA.
- OPSSHIELD says it can't see the exact request that gave the attacker access; it patched two possible entry points and is reviewing the code. It attributes the ~10-hour speed partly to AI tooling (its opinion, no evidence given).

Indicators are in the hunting item linked from our Threat Hunting section.

Sources: [OPSSHIELD: Security Incident Disclosure: manage.opsshield.com (Nov 3)](https://opsshield.com/notice/security-incident-disclosure-servermanage.html) · [OPSSHIELD: cPGuard update channel compromise advisory](https://opsshield.com/notice/cpguard-update-channel-compromise.html)