Jun 29, 2026
1 new incident, 0 with updates.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Started
- LiveHighPartly patched
CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs
QiAnXin XLab disclosed CWPdoor, a stealthy Linux backdoor embedded in trojanized builds of cwpsrv (the Nginx-based web server that serves Control Web Panel's management UI). Attackers with root replace cwpsrv 1.15.10 or 1.24.0 via a fake updater script, restore original file timestamps, and leave a passive backdoor that only fires on HTTP requests carrying valid X-Ngx-Integrity-* timestamp, AES command, and RSA signature headers — those requests are suppressed from access logs. XLab captured the installer on June 29 2026; a September 30 VirusTotal upload from Brazil (alongside Ebury) shows real victims in the wild. More than 340,000 CWP instances were internet-exposed in the prior month. Initial access used to gain root is still unknown. Admins should check for the ngx_http_integrity_helper Unix socket, restore a clean cwpsrv, upgrade CWP, and rotate all panel credentials.
Control Web Panel (CWP) / cwpsrvSince Jun 29, 2026
