What happened. At 02:06 UTC on Nov 2, an unidentified attacker used compromised credentials to get into the update system for cPGuard, a security tool made by OPSSHIELD. It pushed a malicious script in cPGuard versions 5.88.12 through 5.88.19. OPSSHIELD says it caught it within 12 hours, cleared its infrastructure credentials and stopped the script spreading. How the credentials were stolen is still under investigation.
What the script did. It installed a backdoor and collected /etc/shadow and /etc/passwd (the files holding password hashes), root's MariaDB or MySQL config (my.cnf), root's shell history, and root's SSH authorized-keys and known-hosts files. OPSSHIELD estimated late on Nov 2 UTC that 32 files were taken, each tied to one customer server. That count may change and does not show how many servers ran the script.
What to do. Versions 5.88.25 and later remove the backdoor and the files it left. Updating does not undo the theft: any server that may have run a bad version needs new root and database passwords and new SSH keys.
Why this matters to an enterprise. A security agent runs as root and trusts its own update feed, so whoever controls that feed controls every server it protects. Check which tools on your servers auto-update as root, and treat a vendor update-channel breach like a breach of your own servers.