{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs · updates",
  "home_page_url": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026",
  "feed_url": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026/feed.json",
  "description": "QiAnXin XLab disclosed CWPdoor, a stealthy Linux backdoor embedded in trojanized builds of cwpsrv (the Nginx-based web server that serves Control Web Panel's management UI). Attackers with root replace cwpsrv 1.15.10 or 1.24.0 via a fake updater script, restore original file timestamps, and leave a passive backdoor that only fires on HTTP requests carrying valid X-Ngx-Integrity-* timestamp, AES command, and RSA signature headers — those requests are suppressed from access logs. XLab captured the installer on June 29 2026; a September 30 VirusTotal upload from Brazil (alongside Ebury) shows real victims in the wild. More than 340,000 CWP instances were internet-exposed in the prior month. Initial access used to gain root is still unknown. Admins should check for the ngx_http_integrity_helper Unix socket, restore a clean cwpsrv, upgrade CWP, and rotate all panel credentials.",
  "language": "en",
  "_pwn": {
    "slug": "control-web-panel-cwpdoor-backdoor-nov-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-11-06-152e2769",
      "url": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-11-06-152e2769",
      "title": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: The Hacker News and BleepingComputer cover CWPdoor; XLab notes 340,000+ internet-exposed CWP instances and that the root initial-access path remains unknown.",
      "content_text": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: The Hacker News and BleepingComputer cover CWPdoor; XLab notes 340,000+ internet-exposed CWP instances and that the root initial-access path remains unknown.\n\nSource: https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-11-05-7bee160f",
      "url": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-11-05-7bee160f",
      "title": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: QiAnXin XLab publishes the CWPdoor technical analysis: embedded RSA/AES command channel via X-Ngx-Integrity-* headers, log suppression, IOCs, and remediation steps.",
      "content_text": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: QiAnXin XLab publishes the CWPdoor technical analysis: embedded RSA/AES command channel via X-Ngx-Integrity-* headers, log suppression, IOCs, and remediation steps.\n\nSource: https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-09-30-f066a2d0",
      "url": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-09-30-f066a2d0",
      "title": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: VirusTotal receives evidencia.tgz from Brazil containing Ebury (libkeyutils) and a zero-detection cwpsrv.suspeito sample that XLab identifies as CWPdoor, indicating real victims in the wild.",
      "content_text": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: VirusTotal receives evidencia.tgz from Brazil containing Ebury (libkeyutils) and a zero-detection cwpsrv.suspeito sample that XLab identifies as CWPdoor, indicating real victims in the wild.\n\nSource: https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
      "date_published": "2026-09-30T00:00:00.000Z",
      "external_url": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-06-29-47da33b8",
      "url": "https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-06-29-47da33b8",
      "title": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: XLab CTIA captures cwpsrv_update.sh, a root-required fake updater that downloads trojanized cwpsrv builds for versions 1.15.10 and 1.24.0 from 136.0.141.71, restores original timestamps, and deletes history.",
      "content_text": "CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: XLab CTIA captures cwpsrv_update.sh, a root-required fake updater that downloads trojanized cwpsrv builds for versions 1.15.10 and 1.24.0 from 136.0.141.71, restores original timestamps, and deletes history.\n\nSource: https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
      "date_published": "2026-06-29T00:00:00.000Z",
      "external_url": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/",
      "tags": [
        "high"
      ]
    }
  ]
}