CWPdoor
Security incidents tagged CWPdoor. Newest first.
1 CWPdoor incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 92 days (Jun 30–Sep 29)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Show 1 older incident1 older incident
June 2026 1
- HighPartly patched
CWPdoor: trojanized Control Web Panel cwpsrv backdoor runs commands without access logs
QiAnXin XLab disclosed CWPdoor, a stealthy Linux backdoor embedded in trojanized builds of cwpsrv (the Nginx-based web server that serves Control Web Panel's management UI). Attackers with root replace cwpsrv 1.15.10 or 1.24.0 via a fake updater script, restore original file timestamps, and leave a passive backdoor that only fires on HTTP requests carrying valid X-Ngx-Integrity-* timestamp, AES command, and RSA signature headers — those requests are suppressed from access logs. XLab captured the installer on June 29 2026; a September 30 VirusTotal upload from Brazil (alongside Ebury) shows real victims in the wild. More than 340,000 CWP instances were internet-exposed in the prior month. Initial access used to gain root is still unknown. Admins should check for the ngx_http_integrity_helper Unix socket, restore a clean cwpsrv, upgrade CWP, and rotate all panel credentials.
Control Web Panel (CWP) / cwpsrvSince Jun 29, 2026
