Xakerlar cPGuard veb-xavfsizlik to'plami yangilanish infratuzilmasini buzib, orqa eshik va ma'lumot o'g'irlovchi skript tarqatishdi.
cPGuard ishlab chiquvchisi OpsShield bugun ertalab e'lon qilgan ogohlantirishda hujum 2-noyabr kuni soat 02:06 UTC da boshlanganini va 5.88.12 dan 5.88.19 gacha bo'lgan versiyalarga ta'sir qilganini aytdi.
Kompaniya aytishicha, u buzilishni aniqladi va xaker buzilgan cPGuard versiyalarini tarqatganidan keyin 12 soat ichida zararli tarqatishni to'xtatdi.
Kompaniya tasdiqlay olmasa-da, yangilanish tekshiruvlari ma'lum oraliqlarda sodir bo'lishi sababli ba'zi serverlar zararli skriptni qabul qilmagan va ishga tushirmagan bo'lishi mumkinligini aytdi.
Xaker dastlabki kirish huquqini olish uchun qonuniy ma'lumotlardan foydalangan, ammo ular qanday olingani hali aniq emas.
"2-noyabr 2026-yil soat 02:06 UTC da noma'lum xaker buzilgan ma'lumotlardan foydalanib OpsShield yangilanish tarqatish infratuzilmasiga (CDN) ruxsatsiz kirish huquqini oldi," — dedi OpsShield.
"Xaker bu kirish huquqidan foydalanib cPGuard yangilanish kanali orqali zararli skript tarqatdi."
cPGuard — Linux veb-server xavfsizlik to'plami bo'lib, zararli dasturlarni skanerlash, xavfsizlik devorlari va hujumlardan himoya qilishni taklif qiladi.
U odatda xosting firmalari va server ma'murlari tomonidan cPanel, DirectAdmin va Plesk kabi panellar bilan birga ishlatiladi. Namecheap uni VPS va maxsus serverlarda taklif qiladi.
Buzilish oynasi davomida cPGuardni yangilagan foydalanuvchilar o'z mashinalaridagi maxfiy ma'lumotlarga qaratilgan skriptni oldilar:
- Linux parol xeshlar
- Ildiz ma'lumotlar bazasi (MariaDB/MySQL) konfiguratsiyasi
- Ildiz qobiq tarixi
- Ildiz SSH avtorizatsiya va ma'lum xostlar fayllari
O'g'irlangan ma'lumotlar buzilgan hisob orqali OpsShield litsenziya serveriga yuklandi, xakerlar esa uni olish uchun shu hisobdan foydalandi.
OpsShield har bir serverdan qanday ma'lumotlar to'planganini aniqlamagan bo'lsa-da, tekshiruv dalillari tahdid ishtirokchisi har bir mijozdan 32 ta faylni olganini ko'rsatadi.
Tizim ma'murlari har bir cPGuard serverini 5.88.25 yoki undan yuqori versiyaga yangilash, parollarni qayta o'rnatish va ma'lumotlar bazasi ma'lumotlari, bulut sirlarini va SSH kalitlarini aylantirish tavsiya etiladi.
OpsShield ta'kidlashicha, cPGuardni eng so'nggi versiyaga yangilash orqa eshik va tayyorlangan fayllarni o'chiradi; ammo o'g'irlangan ma'lumotlar imkon qadar tezroq bekor qilinishi kerak.
Shuningdek, sotuvchi qo'shimcha ehtiyot chorasi sifatida avval o'rnatilgan OpsShield qo'llab-quvvatlash kirish kalitlarini o'chirish uchun yangilanish chiqarishini aytdi.
BleepingComputer hujum haqida ko'proq ma'lumot olish uchun OpsShield bilan bog'landi va vakil bizga hodisa deyarli uch ming serverga ta'sir qilganini aytdi.
"Biz 2946 ta server ta'sirlanganini va yuqorida aytib o'tilgan ma'lumotlar nusxalanganini aniqladik, shuningdek bizning hisob-kitob tizimi ma'lumotlar bazasi ham nusxalandi. Biz barcha kirish huquqlarini bloklash, ta'sirlangan tizimlarni qayta qurish va eng tez fursatda ommaviy e'lon tayyorlash ustida ishlayapmiz," — dedi kompaniya vakili.
Kompaniya shuningdek mijozlarga ko'rsatmalarga amal qilish, cPGuardni 5.88.25 yoki undan yuqori versiyaga yangilash va potentsial buzilgan serverlarda ochilgan bo'lishi mumkin bo'lgan ma'lumotlarni qayta o'rnatish yoki aylantirishni tavsiya qiladi.
Mavjud himoyangiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security AI agentlari elektron pochta niyati, konteksti va xatti-harakatlarini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace 14 kunlik faqat o'qish skaneri bilan MX o'zgarishlarsiz nima o'tib ketayotganini ko'ring.
Bepul elektron pochta xavfsizlik skaneringizni boshlang.
Attackers have compromised the update infrastructure for the cPGuard web security suite to distribute a backdoor and a data-stealing script.
OpsShield, the cPGuard developer, published an alert earlier today saying the attack began on November 2 at 02:06 UTC and affected versions 5.88.12 through 5.88.19.
The vendor says that it detected the compromise and stopped the malicious distribution within 12 hours after the attacker pushed the compromised cPGuard versions.
Although the company could not confirm, it said that some servers may have not received and run the malicious script due to update checks occurring at specific intervals.
The attacker leveraged legitimate credentials to gain initial access, although it remains unclear how they were obtained.
“On 2 November 2026 at 02:06 UTC, an unidentified attacker used compromised credentials to gain unauthorized access to OpsShield’s update distribution infrastructure (CDN),” OpsShield said.
“The attacker used this access to distribute a malicious script through the cPGuard update channel.”
cPGuard is a Linux web-server security suite offering malware scanning, firewalls, and attack protection.
It is commonly used by hosting firms and server administrators alongside panels such as cPanel, DirectAdmin, and Plesk. Namecheap offers it on VPS and dedicated servers.
Users updating cPGuard during the compromise window received a script that targeted sensitive data on their machines:
- Linux password hashes
- Root database (MariaDB/MySQL) configuration
- Root shell history
- Root SSH authorization and known-hosts files
The stolen data was uploaded to OpsShield’s licensing server through a compromised account, which the attackers then used to retrieve it.
While OpsShield has not established what data was collected from each server, the company's evidence from the investigation shows that the threat actor retrieved 32 files from each customer.
System administrators are advised to update every cPGuard server to version 5.88.25 or later, reset passwords, and rotate database credentials, cloud secrets, and SSH keys.
OpsShield notes that updating to the latest cPGuard version removes the backdoor and staged files; however, stolen credentials must be invalidated as soon as possible.
The vendor also said that, as an extra precaution, it would release an update to remove previously installed OpsShield support-access keys.
BleepingComputer has contacted OpsShield to learn more about the attack, and a spokesperson told us that the incident has impacted nearly three thousand servers.
"We detected 2946 servers were affected and copied the information mentioned, and our billing system database was copied over as well. We are working on blocking all access, rebuilding the affected systems, and preparing for a public announcement at the earliest possible time," the company representative said.
The company also advises customers to follow the instructions and update cPGuard to version 5.88.25 or later, and reset or rotate credentials that may have been exposed on potentially compromised servers.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.