Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Swati KhandelwalNov 06, 2026Malware / Web Security A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server. The researchers, who named the backdoor cwpdoor, captured its installer, a shell script posing as a version update, on June 29. The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0. The researchers do not yet know how attackers get the root access the installer needs. On September 30, an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil. The researchers say this indicates that "real victims already exist in the wild." They give no count of infected servers. The backdoor is cwpsrv itself, rebuilt with extra code, the researchers found in their technical analysis. It behaves like the normal program until a request arrives with a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. It then runs the command carried in the request. When the installer replaces the cwpsrv file, it puts the file's dates back to their original values, so checks with ls and stat show it as unchanged. When the researchers checked, the backdoor file had zero detections out of 63 on VirusTotal. Socket: run ss -axp | grep integrity. A result naming ngx_http_integrity_helper, the Unix socket the backdoor uses, is a sign of infection. Process: run ps aux | grep cwpsrv and look for unexpected helper processes started by cwpsrv. File: run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity and look for the backdoor's header names. In the researchers' example, the socket check found the backdoor on a server where the list of open ports looked normal. The researchers published these indicators: MD5: e505d4ffa21cf494a5dc2d7c8f4f1236 (installer script, cwpsrv_update.sh) MD5: 965aea67fb40de1bab5169ada993349f (backdoored cwpsrv 1.15.10) MD5: d3f4e95113d49ab3991b45e457bda75b (backdoored cwpsrv 1.24.0) URL: https://136.0.141[.]71/static/cwpsrv_update.sh URL: https://136.0.141[.]71/static/cwpsrv_1.15.10 URL: https://136.0.141[.]71/static/cwpsrv_1.24.0 If a server is infected, the researchers recommend three steps: Restore the original cwpsrv from the backup the installer creates in /usr/local/cwpsrv/bin, with a name starting cwpsrv.prev- and ending in a date and time. The researchers' description of the installer says it deletes "the temporary files and backup" after a successful swap, so this copy may be missing. Upgrade to the latest version, then confirm that ss -axp | grep integrity returns nothing. Change all control panel credentials, because the backdoor can run any command. Treat the whole server as compromised and check it for other threats. The archive uploaded from Brazil also held the Ebury malware, an OpenSSH backdoor and credential stealer active since at least 2009. The researchers do not know whether the two are related, and say different attackers may have planted them on the same server. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. linux, Malware, server security, Web Security Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide AI-Generated Fake Login Pages Are Making Account Takeovers Easier China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Attend Live Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security