Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
Summary: Researchers at QiAnXin's XLab found a backdoor, named cwpdoor, in the web server that runs Control Web Panel, a free Linux hosting management panel; the backdoored cwpsrv executes commands sent in web requests whose headers begin with X-Ngx-Integrity and carry a valid timestamp and signature, and those requests never appear in access logs. The installer, a shell script posing as a version update and captured on June 29, requires root access and handles only cwpsrv versions 1.15.10 and 1.24.0, and an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil on September 30, which the researchers say indicates real victims already exist in the wild.
What you should know: The backdoor file had zero detections out of 63 on VirusTotal, and the installer resets file timestamps so ls and stat show it as unchanged - meaning the usual file-integrity and antivirus checks would report a compromised server as clean.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026