Critical · 1 source · latest 14h

Attackers abused OpsShield's cPGuard update channel to push a malicious root update

CRITICAL · BREACHOPSSHIELDredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

Attackers used compromised credentials to push a malicious update through OpsShield's distribution infrastructure between 1 and 2 November, running for about 70 minutes. The fake update ran as root on roughly 2,950 customer servers, exposing password hashes, root SSH keys and MySQL root passwords, and about 7,900 billing portal accounts were accessed. OpsShield has released a clean cPGuard update (v5.88.26), revoked keys and tokens, and advises customers to update, rotate all credentials and rebuild any server the attacker logged into by hand from a backup taken before 1 November.

For IT people · Written by AI from 1 source · Wrong?

What to do

Update cPGuard to the latest version and check that /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511sh are gone, deleting them if they remain.
Change root and all local user passwords, MySQL root and database passwords, and any passwords, API keys or tokens found in root shell histories.
Generate new root SSH keys and remove the old ones from every server that trusted them, treating servers as compromised until this is done.
Reset OpsShield billing portal passwords and turn on two-factor authentication.

Written by AI from the sources, checked against them

Read the full story at the source