Attackers abused OpsShield's cPGuard update channel to push a malicious root update
CRITICAL · BREACHOPSSHIELDredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
Attackers broke into the update system of a company that makes website server security software. For about 70 minutes they sent out a fake update that gave them top-level control over customer servers, and they also stole customer data. The company is urging customers to install a clean update and change their passwords and keys.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Update cPGuard to the latest version and check that /etc/cron.d/i93677, /var/tmp/.i93677/ and /var/tmp/.cpg91511sh are gone, deleting them if they remain.
- Change root and all local user passwords, MySQL root and database passwords, and any passwords, API keys or tokens found in root shell histories.
- Generate new root SSH keys and remove the old ones from every server that trusted them, treating servers as compromised until this is done.
- Reset OpsShield billing portal passwords and turn on two-factor authentication.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
CSO Online
Who and what is in it
Companies
Products