Most business owners never think about the security software their web host runs on the server behind their website. This week gave us a reason to. Attackers broke into the company behind a popular server security tool and used its own update system to push a backdoor onto thousands of web hosting servers. Here's what happened, in plain English, and the questions I'd ask your host.
What happened
The tool is called cPGuard, made by a company called OPSSHIELD. It's a malware scanner and firewall for Linux web servers, commonly used by hosting companies alongside control panels like cPanel, DirectAdmin and Plesk. Its own website says it's built for hosting companies and for small businesses running their own server or VPS.
On November 2, an attacker used stolen credentials to get into OPSSHIELD's update system and sent out fake cPGuard updates, versions 5.88.12 through 5.88.19. Over about 70 minutes, roughly 2,950 customer servers installed the fake update and ran it with full administrator ("root") access.
That fake update did two things. It copied sensitive files and sent them to the attacker, including password hashes, root SSH keys, the main database password where present, the server's command history, and cloud storage keys. And it left behind a hidden backdoor the attacker could use to get back in.
According to OPSSHIELD's later disclosure, the break-in started the day before with a fake customer account and a free trial. The attacker also took billing records for about 7,900 OPSSHIELD customer accounts, with names, addresses, emails and hashed passwords.
What's been fixed
OPSSHIELD says it caught the attack within 12 hours and has shut the attacker out. It released cPGuard 5.88.26, which removes the backdoor, plus a follow-up update that removes a scheduled task the script left behind.
But updating doesn't undo what was copied. As OPSSHIELD puts it, credentials copied before cleanup may still be usable. That's why every affected server also needs new passwords and keys.
Why this matters for your business
This one is unusual because the software that was supposed to protect these servers is what got them broken into. And you'd probably never know it was there. As one analyst told Network World, most website owners have no idea which security agent their hosting provider runs.
It matters because of how hosting works. The same analyst pointed out that one hosting server can hold hundreds of customer websites and databases, and a main database password opens all of them. If your site sits on one of those servers, your website, your forms and your customer data could be within reach, even though you did nothing wrong.
To keep this in perspective: there's no public list of which hosts were affected, and only servers that were online during that short window received the fake update. So this isn't a reason to panic. But you can't tell from the outside, so it's worth asking.
What I'd do this week
- Ask your host whether they use cPGuard on the server your website is on. Analysts are recommending exactly this, then changing your own passwords. Ask in writing so you have the answer on record.
- If they do, ask three follow-ups. Did your server install one of the bad versions (5.88.12 to 5.88.19)? Is it now on 5.88.26 or later? And have they reset the server passwords, the database passwords and the SSH keys?
- Change your own passwords. Your hosting account, your website admin login, FTP or SFTP, and your email. If you're not sure your host has changed the database password your website uses, have your developer do it.
- If you run your own server or VPS with cPGuard, follow OPSSHIELD's steps: check the update history, update, and rotate every password and key. Also reset your OPSSHIELD billing portal password and turn on two-factor login.
- Watch for warning signs. New admin users you didn't add, pages you didn't create, visitors being redirected, or a "this site may be hacked" notice in Google. If you see anything like that, restore from a clean backup and change every password.
If you're lost, we can help
If you don't know who hosts your website, or your host's answer reads like a foreign language, that's normal. HDM has been building and caring for websites out of Springboro, Ohio for 20 years. Send us a request and we'll find out where your site lives, ask the right questions and tell you plainly what we find, or call us at (513) 668-7344.
