{"id":4002,"date":"2026-11-06T07:07:53","date_gmt":"2026-11-06T07:07:53","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4002"},"modified":"2026-11-06T07:07:53","modified_gmt":"2026-11-06T07:07:53","slug":"hackers-hide-linux-backdoor-in-control-web-panel-server-to-execute-commands-without-logs","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4002","title":{"rendered":"Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs"},"content":{"rendered":"
\n

\ue804<\/i>Swati Khandelwal<\/span>\ue802<\/i>Nov 06, 2026<\/span><\/span>Malware \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A backdoor has been found hiding in the web server that runs Control Web Panel<\/strong> (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin’s XLab said this week.<\/p>\n

The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.<\/p>\n

The researchers, who named the backdoor cwpdoor<\/strong>, captured its installer, a shell script posing as a version update, on June 29. The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0. The researchers do not yet know how attackers get the root access the installer needs.<\/p>\n

On September 30, an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil. The researchers say this indicates that \u00abreal victims already exist in the wild.\u00bb They give no count of infected servers.<\/p>\n

The backdoor is cwpsrv <\/strong>itself, rebuilt with extra code, the researchers found in their technical analysis<\/a>. It behaves like the normal program until a request arrives with a valid timestamp and signature in custom headers whose names begin with X-Ngx-Integrity. It then runs the command carried in the request.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

When the installer replaces the cwpsrv file, it puts the file’s dates back to their original values, so checks with ls and stat show it as unchanged. When the researchers checked, the backdoor file had zero detections out of 63 on VirusTotal.<\/p>\n

<\/p>\n

Checking a Server for the Backdoor<\/h3>\n

XLab gives three checks:<\/p>\n