CWPdoor hides inside Control Web Panel and leaves no line in the access log

If you run a website on a server that uses Control Web Panel, the program that serves the panel itself may have been swapped for a copy that still looks legitimate. On November 5, 2026, researchers at XLab, part of QiAnXin, published CWPdoor: The Invisible Backdoor Living Inside Control Web Panel. The backdoor does not scan the internet or call home on its own. It sits inside the panel’s web server and answers only when the operator sends a request it can verify.

What was found

Control Web Panel, formerly CentOS Web Panel, is a free server administration panel for Linux, in the same general family as cPanel and Plesk. Its own interface is served by a program called cwpsrv, a customised server based on Nginx. XLab says the backdoor is not a separate file dropped beside it. The attacker inserted code into the cwpsrv source, recompiled it, and replaced the real binary.

XLab’s monitoring system caught the installer on June 29, 2026: a script named cwpsrv_update.sh, posing as an update. It only handles cwpsrv versions 1.15.10 and 1.24.0. Run as root, it checks the local version, downloads a matching binary from 136.0.141.71, stops the service, overwrites /usr/local/cwpsrv/bin/cwpsrv, and starts it again. If the health check fails, it rolls back. Either way, it puts the original timestamps back on the file and its folder, and it deletes the current shell history entry, so a quick look with ls or stat does not show a recent change. It then reports the result to the same server.

On September 30, 2026, someone in Brazil uploaded an archive named evidencia.tgz to VirusTotal. Inside were two malicious files. One, libkeyutils.so.1.5.2, was widely detected as Ebury, a Linux backdoor and credential stealer that ESET has tracked since at least 2009. The other, cwpsrv.suspeito, was CWPdoor, and at the time it had zero antivirus detections. XLab reads that as evidence of real victims, not a lab experiment. It also says the link to Ebury is unclear: the two could have been planted on the same server by different people. XLab does not know which vulnerability, if any, is used to spread CWPdoor.

QiAnXin’s Hunter platform counted more than 340,000 CWP instances exposed to the internet over the past month. That is the pool of servers that could be targeted. It is not a count of infections.

How the backdoor behaves

In normal use, the modified cwpsrv behaves like the real panel server. The extra code runs only when a request carries three headers: a timestamp, an encrypted command, and a signature. XLab says the timestamp has to fall within five minutes, and the signature has to match a public key embedded in the binary. If either check fails, the request is handled as ordinary traffic. If both pass, a helper process runs the command and the answer comes back encrypted. The same code then tampers with the logging module so that triggering request does not appear in the access log.

That design is why XLab calls it stealthy: the file timestamps look old, the process looks like cwpsrv, and the command itself is missing from the log. It is also why a person browsing a site hosted on the server would not see anything wrong.

What you can do

Most people with a personal site on shared hosting do not run Control Web Panel themselves. If that is you, there is nothing to install and nothing to click. Ask your host only if they tell you the panel was involved.

If you administer a server that runs CWP, XLab’s checks are:

1. Look for a Unix socket named ngx_http_integrity_helper. XLab suggests ss -axp | grep integrity.
2. Look at cwpsrv’s processes for a helper child that should not be there, and search the binary for the string X-Ngx-Integrity.
3. If those are present, treat the host as compromised. XLab says the installer leaves a backup named like cwpsrv.prev- plus a timestamp in /usr/local/cwpsrv/bin. Replace the binary with a clean copy, move to a current version, confirm the socket is gone, and rotate every control-panel credential. Because the backdoor can run arbitrary commands, those passwords and keys should be assumed stolen, and the host should be checked for anything else that was added.

This is a different incident from the hijacked cPGuard update earlier this week. cPGuard is a separate security product, and that case was a poisoned update from the vendor’s own channel. CWPdoor is a rebuilt copy of Control Web Panel’s web server. The same week also included OVHcloud CLI downloads that were swapped for a secret-stealer, another case of a tool administrators trust delivering something else.

How Frame helps

This one is about the server that hosts a site, not a list of customer emails. The checks above are the useful part. If a hosting company later names a breach of account email addresses, Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• A hijacked cPGuard update stole root secrets from about 2,950 web hosting servers: a separate product and a separate attack, also aimed at Linux hosting servers.
• OVHcloud CLI downloads were swapped for a secret-stealer: another trusted admin tool that was replaced with malicious code.

Sources

• XLab (QiAnXin), CWPdoor: The Invisible Backdoor Living Inside Control Web Panel, November 5, 2026
• BleepingComputer, Hackers backdoor Linux servers using trojanized CWP web server, November 5, 2026