cPGuard update channel hijacked to install backdoor on Linux servers

What happened

On November 2, 2026, an attacker abused the update system of cPGuard, a security add-on for Linux hosting servers. Through the regular update channel, a script was sent to customer servers. The script installed a backdoor and collected password hashes and files from the affected systems. The incident became public on November 3, 2026.

This is a supply chain attack. No action by the server operator was needed. Servers that received cPGuard updates automatically during the attack window may have run the malicious script without anyone noticing.

Who is affected

Affected are operators of Linux servers with cPGuard installed, especially those with automatic updates enabled. The advisory mentions versions 5.88.25 and later. The exact affected and cleaned-up versions are not clear from the reports, so check the vendor advisory linked below.

Password hashes were collected, so the risk goes beyond the server itself. User accounts, hosting customers and any service that reuses the same credentials may also be exposed.

What to do now

1. Find every server running cPGuard and note the installed version and whether automatic updates are enabled.
2. Read the vendor advisory linked below and follow its instructions for clean versions and removal of the malicious changes. Until the vendor confirms the update channel is safe, consider pausing automatic cPGuard updates.
3. Treat any server that received cPGuard updates on or after November 2 as possibly compromised until you have checked it.
4. Change the passwords of all system accounts on affected servers, starting with root and administrative users. Also change panel, database and mail passwords where these are stored or reused on the server.
5. Replace SSH keys and API tokens stored on the server, and review authorized_keys files for keys you do not recognise.
6. Tell your hosting customers if their account data or files may have been collected, so they can change their own passwords.
7. If you find clear signs of a backdoor and cannot be sure you removed it fully, rebuild the server from a known clean state and restore data from a backup made before November 2.

How to check whether you are affected

The reports do not include specific indicators of compromise. Check the vendor advisory for file names, hashes or network addresses. Until then, these general checks help:

• Review cPGuard update logs and system logs for update activity on and after November 2.
• Look for new or changed user accounts in /etc/passwd, and new entries in /etc/sudoers and /etc/sudoers.d/.
• Check crontabs (/etc/crontab, /etc/cron.*, crontab -l for each user) and systemd units (systemctl list-unit-files) for entries you did not create.
• Look for recently changed files in system directories, for example with find /etc /usr/bin /usr/sbin /usr/local -mtime -3.
• Review active network connections and listening ports with ss -tulpn and look for unknown processes or outgoing connections.
• Check authorized_keys files for root and all users for unknown keys.

If you find anything unexplained, isolate the server and handle it as a security incident.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://thehackernews.com/2026/11/cpguard-update-channel-hijacked-to.html