# cPGuard security advisory: Update channel compromise

Compromised CDN credentials let an attacker push a malicious script via cPGuard updates 5.88.12–5.88.19, harvesting /etc/shadow, DB configs and SSH keys to the vendor's licensing server.

- Payout: Real-world hack
- Severity: critical
- Program: OPSSHIELD (cPGuard)
- Analysis by: OPSSHIELD (cPGuard)
- Disclosed: 2026-11-03
- Write-up quality: 6/10
- Original: https://opsshield.com/notice/cpguard-update-channel-compromise.html
- Library page: https://bugbountylibrary.com/r/blog%3Aopsshield-com-notice-cpguard-update-channel-compromise-html
- Tags: area:oss domain:oss impact:data-leak impact:integrity impact:mass-exploit kind:incident platform:threat-intel sev:critical tech:linux technique:default-creds vuln:misconfiguration vuln:secrets-leak

**Target:** Software update distribution CDN and licensing server
**Root cause:** Attacker obtained valid credentials for OPSSHIELD's update distribution CDN and used them to publish a malicious script as a legitimate cPGuard update.
**Steps:**
1. Obtain compromised credentials for OPSSHIELD's update distribution infrastructure (CDN).
2. Publish malicious script `cpguard-v58812-i91511.sh` as updates 5.88.12–5.88.19 in the cPGuard update channel.
3. Script stages collection dir `/var/tmp/.cpg91511`, archives loot to `/var/tmp/.cpg91511/loot.tgz`, and installs backdoor shell `/var/tmp/.cpg91511_sh`.
4. Script collects `/etc/shadow`, `/etc/passwd`, root `my.cnf`, root shell history, and root SSH authorized_keys/known_hosts.
5. Script uploads collected data to OPSSHIELD's licensing server under a compromised account.
6. Attacker retrieves staged data from the licensing server later.
**How found:** Vendor detected the attack within 12 hours of the malicious updates launching; investigation traced the script's collection directory, backdoor and uploads to the licensing server.
**Exploitation:** Supply-chain style: poisoned update channel delivers script to every server that checks for updates during the window; script runs as root, exfiltrates credentials and keys to the vendor's own licensing server under an attacker-controlled account, then attacker retrieves them. Estimated 32 collected files retrieved, each corresponding to a customer server.
**Escalation:** Harvested /etc/shadow hashes, DB creds, cloud tokens (S3, DigitalOcean) and SSH private keys enable lateral movement and offline cracking beyond the initial servers.
**Insight:** Update channels are a high-value supply-chain target: monitor for unexpected version bumps, diff update artifacts, and alert on new outbound connections from the updater process to vendor-owned infrastructure.

## Proof of concept (copied exactly from the original report)

**grep command to check update history**

```
grep 'Successfully updated' /opt/cpguard/logs/install_log
```

**cpgcli update and version verify commands**

```
cpgcli update --start

- 
 
## Verify the installed version

 Verify installed version

 Copy

cpgcli --version

 Verify that the installed version is 5.88.25 or later.
```