OpsShield says hijacked cPGuard update backdoored about 2,950 Linux servers
OpsShield says the fake cPGuard update ran as root and targeted password hashes, SSH keys, database credentials and shell history. It has not established which files were collected from each server.
By RuntimeWire Staff · Published
Primary source: BleepingComputer
Why it matters
A security agent runs with root trust, so a compromised update path reaches the credentials that protect the whole server. OpsShield now has to prove its signing, billing and licensing systems deserve that trust again.
Attackers turned the update channel for cPGuard, a Linux web-server security suite made by OpsShield, into a delivery route for a script that installed a backdoor and collected root-level credentials from customer servers. OpsShield says about 2,950 customer servers ran the fake update, and told BleepingComputer that it detected 2,946 affected servers.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.