# CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs · pwn.watch > QiAnXin XLab disclosed CWPdoor, a stealthy Linux backdoor embedded in trojanized builds of cwpsrv (the Nginx-based web server that serves Control Web Panel's management UI). Attackers with root replace cwpsrv 1.15.10 or 1.24.0 via a fake updater script, restore original file timestamps, and leave a passive backdoor that only fires on HTTP requests carrying valid X-Ngx-Integrity-* timestamp, AES command, and RSA signature headers — those requests are suppressed from access logs. XLab captured the installer on June 29 2026; a September 30 VirusTotal upload from Brazil (alongside Ebury) shows real victims in the wild. More than 340,000 CWP instances were internet-exposed in the prior month. Initial access used to gain root is still unknown. Admins should check for the ngx_http_integrity_helper Unix socket, restore a clean cwpsrv, upgrade CWP, and rotate all panel credentials. Page: https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026 · generated 2026-11-06T10:56:42.467Z ## Status - Severity: high · status: live · patch: partial - Product: Control Web Panel (CWP) / cwpsrv - Started: 2026-06-29 - Affected: cwpsrv 1.15.10 and 1.24.0 replaced by trojanized binaries (installer only targets these two versions); Any CWP host where an attacker already has root - Fixed in: No vendor CVE patch: restore a clean cwpsrv binary (or cwpsrv.prev-* backup if still present), upgrade to the latest CWP/cwpsrv, confirm ss -axp | grep integrity returns nothing, rotate all panel credentials, and treat the host as compromised ## Follow this incident - RSS (one item per update): https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026.json - This file: https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026/llms.txt ## Updates (newest first) - 2026-11-06: The Hacker News and BleepingComputer cover CWPdoor; XLab notes 340,000+ internet-exposed CWP instances and that the root initial-access path remains unknown. (https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html) - 2026-11-05: QiAnXin XLab publishes the CWPdoor technical analysis: embedded RSA/AES command channel via X-Ngx-Integrity-* headers, log suppression, IOCs, and remediation steps. (https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/) - 2026-09-30: VirusTotal receives evidencia.tgz from Brazil containing Ebury (libkeyutils) and a zero-detection cwpsrv.suspeito sample that XLab identifies as CWPdoor, indicating real victims in the wild. (https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/) - 2026-06-29: XLab CTIA captures cwpsrv_update.sh, a root-required fake updater that downloads trojanized cwpsrv builds for versions 1.15.10 and 1.24.0 from 136.0.141.71, restores original timestamps, and deletes history. (https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/) ## Fix brief # Security brief: CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs Source: https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 09:49 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is QiAnXin XLab disclosed CWPdoor, a stealthy Linux backdoor embedded in trojanized builds of cwpsrv (the Nginx-based web server that serves Control Web Panel's management UI). Attackers with root replace cwpsrv 1.15.10 or 1.24.0 via a fake updater script, restore original file timestamps, and leave a passive backdoor that only fires on HTTP requests carrying valid X-Ngx-Integrity-* timestamp, AES command, and RSA signature headers — those requests are suppressed from access logs. XLab captured the installer on June 29 2026; a September 30 VirusTotal upload from Brazil (alongside Ebury) shows real victims in the wild. More than 340,000 CWP instances were internet-exposed in the prior month. Initial access used to gain root is still unknown. Admins should check for the ngx_http_integrity_helper Unix socket, restore a clean cwpsrv, upgrade CWP, and rotate all panel credentials. Severity detail: Post-root persistence on hosting control-panel servers; signed covert command channel with access-log suppression; 340k+ internet-exposed CWP instances; VT sample with zero detections; real victims confirmed - Product: Control Web Panel (CWP) / cwpsrv ## Affected versions - cwpsrv 1.15.10 and 1.24.0 replaced by trojanized binaries (installer only targets these two versions) - Any CWP host where an attacker already has root ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - No vendor CVE patch: restore a clean cwpsrv binary (or cwpsrv.prev-* backup if still present), upgrade to the latest CWP/cwpsrv, confirm ss -axp | grep integrity returns nothing, rotate all panel credentials, and treat the host as compromised After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes CWP admins: run ss -axp | grep integrity, strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity, and check for unexpected cwpsrv helper processes. If infected, restore a clean binary, upgrade CWP, rotate all panel credentials, and hunt for other malware (Ebury co-presence is possible). This is post-root persistence, not a CWP auth bypass CVE. ## Latest updates - Nov 6, 2026: The Hacker News and BleepingComputer cover CWPdoor; XLab notes 340,000+ internet-exposed CWP instances and that the root initial-access path remains unknown. - Nov 5, 2026: QiAnXin XLab publishes the CWPdoor technical analysis: embedded RSA/AES command channel via X-Ngx-Integrity-* headers, log suppression, IOCs, and remediation steps. - Sep 30, 2026: VirusTotal receives evidencia.tgz from Brazil containing Ebury (libkeyutils) and a zero-detection cwpsrv.suspeito sample that XLab identifies as CWPdoor, indicating real victims in the wild. - Jun 29, 2026: XLab CTIA captures cwpsrv_update.sh, a root-required fake updater that downloads trojanized cwpsrv builds for versions 1.15.10 and 1.24.0 from 136.0.141.71, restores original timestamps, and deletes history. ## Advisories - [CWPdoor: The Invisible Backdoor Living Inside Control Web Panel](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/) (QiAnXin XLab) ## Write-ups & news - [Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs](https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html) - [Hackers backdoor Linux servers using trojanized CWP web server](https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/) --- Machine-readable: https://pwn.watch/i/control-web-panel-cwpdoor-backdoor-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.