Researchers at Qianxin’s XLab found a Control Web Panel Linux backdoor living inside the panel’s own web server component, and published their analysis on 5 November 2026. They call it CWPdoor. It runs commands an attacker sends over the network, and the one request that triggers it never appears in the server’s own access log.
XLab’s researchers, who go by Alex.Turing and Acey9, first saw the malware on 29 June 2026 through their own threat-monitoring system. A sample surfaced again in a file archive uploaded to a public malware-scanning site on 30 September 2026, with zero antivirus detections despite containing the backdoor.
What Is Control Web Panel, and Why Target cwpsrv?
Control Web Panel is a free tool for managing Linux servers through a web interface, covering websites, DNS and email without the command line. cwpsrv is CWP’s own dedicated web server, the component that serves the panel and its built-in applications. Backdooring cwpsrv puts the attacker inside the same process that already handles the panel’s own traffic.
How Does an Attacker Install the Control Web Panel Linux Backdoor?
XLab says CWPdoor does not break into a clean server by itself. It is deployed only after an attacker already has root access, gained through a route XLab says it has not yet identified. From there, the chain runs in order.
- Attacker already has rootgained through a route XLab has not identified
- Legitimate web server binary replaceda disguised update script swaps in a version rebuilt from altered source codeTechnique T1554 (MITRE ATT&CK, opens in a new tab)
- File timestamps resetso the replaced file looks untouched by a normal checkTechnique T1070.006 (MITRE ATT&CK, opens in a new tab)
- Shell history clearedso the command that made the change leaves no traceTechnique T1070.003 (MITRE ATT&CK, opens in a new tab)
- Backdoored server runs normallyit serves real traffic exactly like the original, so nothing looks wrong day to day
- One specific request arrivesit carries a cryptographic signature only the attacker can produce
- Command runs, that one log line is skippedthe response returns dressed as ordinary web traffic
The replacement binary is a recompiled version of the same program, not a separate file dropped alongside it. A casual look at the server shows the expected process under its expected name. XLab says the deployment script also restores the file’s original timestamps, so a routine timestamp check does not flag it either.
Is CWPdoor Already Used Against Real Victims?
XLab says yes. The archive uploaded to the scanning site in September 2026 did not come from a test lab; it came from an actual compromised server in Brazil. XLab’s own words are that this shows “real victims already exist in the wild,” not just a building exercise.
The archive held a second malicious file too. Most antivirus engines correctly flagged it as Ebury, a known Linux backdoor family, while the same engines gave zero detections for the CWPdoor file alongside it. XLab says the link between the two is unclear. It may be that two different attackers backdoored the same server independently.
How Does the Backdoor Stay Out of the Logs?
Ordinary requests pass through cwpsrv exactly as they would on an unmodified install, and the server logs them as usual. The backdoor wakes up only for one specific kind of request, built with a cryptographic signature and a time limit that only the attacker can produce. XLab describes this check as working like a signed, timed key: a copy of the request without the right signature does nothing.
When the right request arrives, the backdoor swaps out the part of the server that would normally write that single log line. The command runs, and the response goes back to the attacker with no record of it. Every other request, from real visitors or from a security scan, is logged as usual.
Who Is Exposed, and Why?
XLab’s own network-scanning platform counted more than 340,000 internet-facing CWP installations during its monitoring window. That count measures how many CWP servers are reachable from the internet, which is the pool an attacker could target if it gained root by any means. It is not a count of servers already carrying the backdoor.
XLab examined backdoored samples built on two specific cwpsrv versions, 1.15.10 and 1.24.0. The write-up does not say whether other versions were also rebuilt this way, because XLab studied the samples it found rather than every possible build.
What Does This Mean If an Attacker Already Needs Root?
A backdoor that needs root to install might look like a small addition to an already serious compromise. XLab’s finding is about what happens after that point: a normal-looking server that an incident responder cannot catch by reading its own logs. CWP manages many customer websites on one host, so a backdoored panel can become a quiet, repeatable foothold for everything it runs, long after the original break-in is forgotten.
What Does Control Web Panel’s Own Vendor Say?
CWP’s own changelog lists version 1.30.1, dated 3 November 2026, as a security and stability update. It lists version 1.30, dated 31 October 2026, as a larger release with a new update-verification system. Neither entry mentions this backdoor, as of 6 November 2026. Both releases are newer than the two versions, 1.15.10 and 1.24.0, that XLab found rebuilt with CWPdoor.
Running a current, officially sourced install does not by itself undo a backdoor planted by an attacker who already has root. It does mean an administrator is not relying on one of the two specific old builds XLab examined.
How Can Defenders Check for the Control Web Panel Linux Backdoor?
XLab’s write-up gives specific technical indicators: a distinct child-process pattern, a named inter-process socket and marker strings inside the binary. We do not reproduce those details here. Administrators who want the exact checks should read XLab’s write-up directly and run its tests against their own installs. The general defender steps below do not depend on those exact indicators.
- Verify your binary against the vendorCompare your installed cwpsrv binary against a checksum from CWP’s own distribution, never from a script received by email or a third party.
- Update only through CWP’s own channelInstall new versions only from CWP’s built-in update system, and confirm the version number after every update.
- Treat panel credentials as compromised if you find tamperingXLab says a server showing signs of this backdoor should have every password and key stored in the panel rotated.
- Look for how root was obtainedCWPdoor needs root already installed, so review other logins, panel modules and exposed services for the real way in.
- Read XLab’s own write-up for the exact indicatorsIts process, socket and binary-string checks are specific enough to run directly against your own install.
XLab says it does not yet know which vulnerability or technique gives attackers the root access CWPdoor needs. That gap is the main open question in its own write-up, and it is why reviewing how root was obtained matters as much as removing the backdoor itself.
For a similar case of a backdoor hidden inside legitimate software rather than dropped as a separate file, see our write-up on the BRICKSTORM backdoor hiding in VMware vCenter. Our backdoor glossary entry and our page on indicator removal cover the wider techniques this case uses.