cPGuard backdoor delivered through auto-update steals root SSH keys and database configs from Linux web servers

cPGuard Backdoor: Your CMS Passwords May Already Be Copied

04.11.2026 siteguarding2

A cPGuard backdoor went out through the product's own auto-update on 2 November 2026. OpsShield, the vendor, told BleepingComputer that 2,946 servers were affected, and its investigation shows the attacker retrieved root-level secrets from them. If your WordPress or Joomla site runs on one of those servers, your database password may already be copied. The vendor's fix does not change that.

cPGuard update hack: graphic listing affected cPGuard builds 5.88.12 to 5.88.19 on a compromised Linux hosting server

cPGuard Update Hack: What Site Owners on Affected Servers Must Do

04.11.2026 siteguarding2

The cPGuard update hack began at 02:06 UTC on 2 November 2026, when an attacker used stolen credentials to push a data-stealing script through the update channel of OpsShield's Linux server security suite. OpsShield says 2,946 servers were affected. If your site lives on one of them, someone may already have your database password, and updating cPGuard does not change that.