OPSSHIELD is urging administrators to install cPGuard 5.88.25 or later after an attacker distributed a malicious script through its update channel.
The company’s November 3 advisory identifies updates 5.88.12–5.88.19 as affected. It says compromised credentials enabled access to distribution infrastructure, and confirms that the attacker retrieved some collected data from its licensing server.
Cleanup and credential exposure
The corrective release removes the known backdoor and staged files. It cannot invalidate credentials already copied. OPSSHIELD advises potentially affected operators to reset local account passwords from a trusted recovery environment and rotate exposed database, cloud and SSH credentials.
Update-history entries can show that an affected release was installed, but do not establish whether the script ran or what left a particular server.
Scope remains under investigation
OPSSHIELD has provisionally linked confirmed data retrieval to 32 customer servers. It is still assessing the broader exposure. Administrators should follow the evolving advisory and contact OPSSHIELD when server integrity is uncertain.
Source: OPSSHIELD security advisory.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
