I deleted all my SSH keys
The gist
A stolen update key let an attacker push a fake cPGuard update to about 2,950 customer servers.
Servers that ran it should treat root SSH keys as stolen.
How it unfolded
- Nov 2, 2026A fake cPGuard update ran as root on customer servers between 02:08 and 03:20 UTC, reading /etc/shadow, /etc/passwd, root SSH keys and authorized_keys under /root/.ssh, /root/.my.cnf and root shell history.
- Nov 3, 2026OPSSHIELD disclosed that an attacker got into its billing and licensing systems, took the update-publishing key and pushed the fake update; about 2,950 customer servers ran it and about 7,900 billing portal accounts were copied.
- Nov 5, 2026OPSSHIELD guidance told customers to update cPGuard to at least 5.88.26, remove leftover files, change root and local user passwords, and generate new root SSH keys and remove the old ones from authorized_keys.
Key terms
- root
- A special superuser account in computing used for system administration with unrestricted system-wide privileges.
- SSH keys
- Cryptographic credentials used to authenticate a client to a server over the Secure Shell protocol.
- cPanel
- Commercial web hosting control panel software that provides a browser-based interface for managing websites and servers.
Source: Wikipedia