Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Breaches & attacks
LiveHighPartly patchedBreaches & attacks

CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs

Control Web Panel (CWP) / cwpsrv

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

QiAnXin XLab disclosed CWPdoor, a stealthy Linux backdoor embedded in trojanized builds of cwpsrv (the Nginx-based web server that serves Control Web Panel's management UI). Attackers with root replace cwpsrv 1.15.10 or 1.24.0 via a fake updater script, restore original file timestamps, and leave a passive backdoor that only fires on HTTP requests carrying valid X-Ngx-Integrity-* timestamp, AES command, and RSA signature headers — those requests are suppressed from access logs. XLab captured the installer on June 29 2026; a September 30 VirusTotal upload from Brazil (alongside Ebury) shows real victims in the wild. More than 340,000 CWP instances were internet-exposed in the prior month. Initial access used to gain root is still unknown. Admins should check for the ngx_http_integrity_helper Unix socket, restore a clean cwpsrv, upgrade CWP, and rotate all panel credentials.

Why this severity: Post-root persistence on hosting control-panel servers; signed covert command channel with access-log suppression; 340k+ internet-exposed CWP instances; VT sample with zero detections; real victims confirmed

Started
Jun 29, 2026

Follow this incident

Discuss on X ↗

Affected

  • cwpsrv 1.15.10 and 1.24.0 replaced by trojanized binaries (installer only targets these two versions)
  • Any CWP host where an attacker already has root

Fixed in

  • No vendor CVE patch: restore a clean cwpsrv binary (or cwpsrv.prev-* backup if still present), upgrade to the latest CWP/cwpsrv, confirm ss -axp | grep integrity returns nothing, rotate all panel credentials, and treat the host as compromised

Timeline4

  1. The Hacker News and BleepingComputer cover CWPdoor; XLab notes 340,000+ internet-exposed CWP instances and that the root initial-access path remains unknown.

  2. QiAnXin XLab publishes the CWPdoor technical analysis: embedded RSA/AES command channel via X-Ngx-Integrity-* headers, log suppression, IOCs, and remediation steps.

  3. VirusTotal receives evidencia.tgz from Brazil containing Ebury (libkeyutils) and a zero-detection cwpsrv.suspeito sample that XLab identifies as CWPdoor, indicating real victims in the wild.

  4. XLab CTIA captures cwpsrv_update.sh, a root-required fake updater that downloads trojanized cwpsrv builds for versions 1.15.10 and 1.24.0 from 136.0.141.71, restores original timestamps, and deletes history.

Advisories1

News & write-ups2

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo