An attacker breached the cPGuard update system on November 2 and deployed a malicious script to customers' Linux servers This article explores breached cpguard update. . The script introduced a backdoor and obtained password hashes and other sensitive files from servers that were running it, according to OPSSHIELD, the creator of cPGuard.
Although the credentials copied by the script may still function after the update, users of servers that ran the script will need to change their passwords and keys to ensure security.
Administrators can verify if a server has installed the vulnerable version by examining its update log: execute 'grep 'Successfully updated'' on the /opt/cpguard/logs/install_log directory. The script gathered these data points: /etc/shadow and /etc/passwd, root's MariaDB or MySQL configuration (my.cnf), root's shell history, and the SSH authorization and known-hosts files for root. Weak, common, or previously leaked passwords can be cracked offline by testing guesses, and even strong ones still require resetting.
Additionally, they should perform these actions on any servers where the script executed or may have executed: OPSSHIELD is not suggesting a full reset or operating system rebuild as a standard procedure, and notes that this view might evolve as the investigation progresses. Administrators who discover additional signs of compromise or cannot confirm a server is clean should seek a case-by-case review from OPSSHIELD Support, which might lead to a rebuild.
