A free trial, a billing portal, one stolen key: how a security tool pushed a backdoor to 2,950 Linux servers.

01 Eleven hours, from trial to root

cPGuard banned them twice that evening. It did not matter. At 22:50 the attacker sent crafted requests to the portal’s callback pages, and by 22:58 they could run commands on the billing and licensing server. OPSSHIELD says its logs do not record the exact request that did it.

Somewhere on that server was an access key for the update storage. At 02:04 on 2 November the attacker used it to upload a fake update. At 02:08 the first agents installed it. At 02:13 the attacker copied three of OPSSHIELD’s cloud servers. The fake build kept installing until 03:20, and OPSSHIELD detected it within 12 hours [ OPSSHIELD advisory ] .

02 What the fake update took

The payload was a short script, versions 5.88.12 to 5.88.19. On each server it read /etc/shadow and /etc/passwd, root’s SSH keys and known hosts, the MySQL root configuration, root’s shell history and, on a few servers, S3 storage keys. It sent them out, then left a setuid-root shell in /var/tmp and a scheduled task in /etc/cron.d [ OPSSHIELD disclosure ] .

Read that list as an attacker would. Shell history holds the passwords admins typed by mistake and the API tokens they pasted. Root’s SSH keys open every other server that trusts this one. On a shared hosting box, the MySQL root password opens every customer’s database. A clean update removes the shell. It does not take any of that back, which is why OPSSHIELD tells customers to rotate everything [ BleepingComputer, via daily.dev ] .

03 The agents you let update themselves

If you run cPGuard, OPSSHIELD’s steps come first: update to the latest build (it names 5.88.26 as the clean one), check /opt/cpguard/logs/install_log for 5.88.12 to 5.88.19, and confirm /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511_sh are gone [ OPSSHIELD ] . Then rotate every secret the script could read.

If you do not run cPGuard, count the agents on your servers that fetch their own updates and run as root. A typical hosting server carries several: security, backup, monitoring, remote management, the panel. Each vendor’s release pipeline is part of your attack surface.

OPSSHIELD found it, stopped it and published its full timeline within a day. Find out now how far a poisoned update would get in your estate, before a vendor’s key ends up in someone else’s hands. Enterprise-grade. Not enterprise-priced.