NRG Networks Inc.

Linux security product cPGuard from OPSSHIELD . An attacker reportedly gained access to OPSSHIELD's update distribution infrastructure using compromised credentials and pushed a malicious update through the trusted cPGuard update channel. The malicious script installed a backdoor and collected sensitive server data. Affected Versions The compromised updates were distributed in cPGuard versions 5.88.12 through 5.88.19 . Data Potentially Stolen The malicious script reportedly collected: /etc/shadow password hashes /etc/passwd Root MariaDB/MySQL configuration files Root shell history Root SSH authorized keys and known-hosts files This could expose credentials, SSH keys, and other sensitive administrative information. Recommended Actions Immediately update cPGuard to version 5.88.25 or later. Treat any server that installed versions 5.88.12-5.88.19 as potentially compromised. Rotate: Root passwords Local account passwords SSH keys API keys and secrets stored on the system Review l...