CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs · updates https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026 QiAnXin XLab disclosed CWPdoor, a stealthy Linux backdoor embedded in trojanized builds of cwpsrv (the Nginx-based web server that serves Control Web Panel's management UI). Attackers with root replace cwpsrv 1.15.10 or 1.24.0 via a fake updater script, restore original file timestamps, and leave a passive backdoor that only fires on HTTP requests carrying valid X-Ngx-Integrity-* timestamp, AES command, and RSA signature headers — those requests are suppressed from access logs. XLab captured the installer on June 29 2026; a September 30 VirusTotal upload from Brazil (alongside Ebury) shows real victims in the wild. More than 340,000 CWP instances were internet-exposed in the prior month. Initial access used to gain root is still unknown. Admins should check for the ngx_http_integrity_helper Unix socket, restore a clean cwpsrv, upgrade CWP, and rotate all panel credentials. en Fri, 06 Nov 2026 00:00:00 GMT CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: The Hacker News and BleepingComputer cover CWPdoor; XLab notes 340,000+ internet-exposed CWP instances and that the root initial-access path remains unknown. https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026 https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-11-06-152e2769 Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html">Source</a></p> CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: QiAnXin XLab publishes the CWPdoor technical analysis: embedded RSA/AES command channel via X-Ngx-Integrity-* headers, log suppression, IOCs, and remediation steps. https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026 https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-11-05-7bee160f Thu, 05 Nov 2026 00:00:00 GMT high <p><a href="https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/">Source</a></p> CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: VirusTotal receives evidencia.tgz from Brazil containing Ebury (libkeyutils) and a zero-detection cwpsrv.suspeito sample that XLab identifies as CWPdoor, indicating real victims in the wild. https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026 https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-09-30-f066a2d0 Wed, 30 Sep 2026 00:00:00 GMT high <p><a href="https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/">Source</a></p> CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs: XLab CTIA captures cwpsrv_update.sh, a root-required fake updater that downloads trojanized cwpsrv builds for versions 1.15.10 and 1.24.0 from 136.0.141.71, restores original timestamps, and deletes history. https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026 https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026#2026-06-29-47da33b8 Mon, 29 Jun 2026 00:00:00 GMT high <p><a href="https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/">Source</a></p>