Vendor incident, severity critical
OPSShield cPGuard update infrastructure compromised; malicious root-level update pushed to ~2,950 servers
Published
An attacker compromised OPSShield's update infrastructure and uploaded fake cPGuard updates (5.88.12 through 5.88.19) on November 2, 2026. About 2,950 customer servers installed the update and ran it as root, exfiltrating password hashes, root SSH keys, the MySQL root password, root shell history and cloud storage keys, and leaving a hidden root shell. The attacker also stole contact details and bcrypt-hashed passwords of about 7,900 customers from OPSShield's billing and licensing server.
What's affected
- opsshieldevery version
Exposure window: UTC.
What to do
- Check whether a malicious cPGuard version (5.88.12 through 5.88.19) was installed, then update to 5.88.26 or later and confirm the malicious scheduled task and hidden root shell are removed
- Reset root and other local account passwords from a trusted recovery environment, and rotate database passwords, S3 keys, DigitalOcean tokens and any secrets in root's shell history
- Replace SSH private keys under the root account and remove the old public keys from every system that trusts them
- Reset the OPSShield billing portal password and enable two-factor login
- If the attacker logged in by hand, rebuild the server from a clean backup taken before November 1
Secrets to rotate if you were affected
SSH keys, Cloud credentials, Database credentials, Environment variables.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident opsshield-cpguard-supply-chain-2026-11References
Notice opsshield-cpguard-supply-chain-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.