cPGuard security tool update channel abused; root secrets taken from about 2,950 Linux hosts

OPSSHIELD disclosed that an attacker registered a customer account under a false identity, broke into its billing and licensing server, stole the keys used to publish updates and pushed a fake cPGuard update for about 70 minutes on Nov 2 ^[1][4]. The company says about 2,950 customer servers that ran the fake update had password hashes, root SSH keys, MySQL root passwords and shell history copied, and about 7,900 billing portal accounts exposed names, companies, postal addresses, emails and hashed passwords ^[1][3]. What to do now: update cPGuard to the latest version and confirm /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh are gone; if the server was online 02:08–03:20 UTC on Nov 2, change root and local passwords, root SSH keys, MySQL passwords and tokens in shell history, and reset the OPSSHIELD billing portal password with two-factor login ^[1][2].

Industries mainly affected: Technology

1. Run cpgcli update --start to update cPGuard to the latest version and confirm /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh are gone; delete them if not ^[1][3].
2. Check grep 'Successfully updated' /opt/cpguard/logs/install_log for versions 5.88.12–5.88.19; an entry means potential compromise, and no entry does not prove safety ^[2].
3. Change root and all local passwords, generate new root SSH keys and remove old public keys from servers that trusted them, and rotate the MySQL root password and keys/tokens in shell history and /root/.s3cfg ^[1].
4. Reset your manage.opsshield.com password and enable two-factor login; if OPSSHIELD says the attacker logged in to your server by hand, rebuild from a clean backup taken before Nov 1 ^[1].