OpsShield says an attacker entered its billing and licensing infrastructure and stole access used to distribute cPGuard updates. Its November 3 incident disclosure reports that customer agents installed a malicious update between 02:08 and 03:20 UTC on November 2.
The vendor estimates that about 2,950 customer servers ran the update. It also reports exposure of approximately 7,900 billing-portal accounts, including contact information and hashed passwords. These are separate populations and should not be added together as a count of compromised servers.
According to OpsShield, the update copied sensitive root-level files, including password hashes, SSH material, database credentials where present and shell history. The company published a clean 5.88.26 update and describes revoking infrastructure access and rebuilding affected internal systems.
The later disclosure supersedes parts of an earlier advisory. OpsShield says its logs do not reveal the exact request that initially enabled command execution. Its investigation therefore identifies the affected entry system while leaving the precise initial mechanism unresolved.
NAOAT analysis
The incident connects two trust relationships that customers may experience as separate services: a vendor’s commercial account portal and its software distribution channel. Once the attacker reached publishing credentials, the update mechanism carried the compromise outward to customer machines.
Cleanup and recovery also have different endpoints. Removing a malicious file changes the machine’s present state; it cannot withdraw a secret that has already been copied. That distinction explains why the vendor’s response includes credential replacement as well as a clean software release.
The changing disclosure is consequential for incident reporting. Early counts of retrieved files and later estimates of affected servers measure different things. Keeping the denominator and disclosure date visible gives operators a more accurate account than selecting the largest number or treating an initial estimate as a final finding.