cPGuard Update Hijack Exfiltrates 32 /etc/shadow Files via Compromised OPSSHIELD Credentials

The attacker distributed a script that harvested /etc/shadow, /etc/passwd, root my.cnf, shell history, and SSH known_hosts files, then uploaded them via OPSSHIELD's own licensing endpoint. Detection occurred within twelve hours; version 5.88.25 later removed the artifacts. Log checks via grep on install_log confirm exposure on servers that pulled those builds, though not every server polls at the same interval.

Server-side evidence consists of 32 exfiltrated files recovered from the licensing server before the attacker account was revoked. No additional persistence mechanisms beyond the backdoor and data collection have been identified. The initial credential vector remains under investigation, consistent with prior supply-chain incidents where static update credentials were the sole weak point.

This event follows the established pattern of credential-stuffing or phishing leading to update-channel abuse rather than novel zero-day exploitation. Technical indicators show only the exfiltration of hashed and plaintext secrets; no state attribution is supported by the available logs. Affected administrators must rotate all root credentials and SSH keys regardless of current version, as offline cracking of weak hashes remains feasible.

Next actions center on mandatory rollout of 5.88.25, verification that no lower versions remain, and full credential rotation from trusted recovery environments. OPSSHIELD continues forensic review; independent audits of the update signing process would reduce recurrence risk.