Science & Tech · Cybersecurity · 2 hrs ago
CWPdoor malware targets Linux servers running Control Web Panel
CWPdoor is a backdoor targeting Linux servers that use Control Web Panel, a tool for managing web hosting services.
Researchers at XLab found that an infection script replaces the panel’s legitimate server program with a malicious version.
The malware waits for an attacker’s specially crafted request before running commands, and it hides those requests from server logs.
More than 340,000 CWP instances were publicly exposed on the internet over the past month, though that does not mean they were all infected.
Researchers found CWPdoor in an archive that also contained Ebury malware, but the link between the two remains unclear.
Administrators should check for signs of infection and, if confirmed, replace the malicious program, update the software, change control panel passwords and investigate for other malware.
CWPdoor is a Linux backdoor distributed through a trojanized version of cwpsrv, the web server used by Control Web Panel.
The malware remains dormant until an attacker activates it with a specially crafted HTTP request.
Researchers at XLab said it encrypts commands and suppresses server logs to evade detection.
More than 340,000 CWP instances were exposed on the public web over the past month, according to XLab.
Researchers advise administrators to check for signs of infection and replace compromised files, update software and rotate credentials.
- Who
- The attackers distributing CWPdoor and the Linux server administrators potentially affected.
- What
- A trojanized cwpsrv binary installs CWPdoor, a passive backdoor that can execute commands sent by an attacker.
- When
- Researchers discovered the malware on June 29; the articles were published on November 5, 2026.
- Where
- Linux servers running Control Web Panel.
- Why
- Not stated
This story does not have two clearly opposing sides.
Researchers discovered CWPdoor after capturing a script posing as an updater that replaced the legitimate cwpsrv binary.
Researchers saw CWPdoor uploaded to VirusTotal in an archive that included the Ebury backdoor.
An ESET report said Ebury had infected nearly 400,000 servers since it emerged.
SC Media and BleepingComputer published reports about CWPdoor.
- Malware
- CWPdoor
- Affected software
- Control Web Panel, which uses the cwpsrv web server
- Exposed instances
- More than 340,000 CWP instances on the public web over the past month, according to XLab
- Malicious binary versions
- cwpsrv versions 1.15.10 and 1.24.0
- Command encryption
- AES-256-CBC
- Detection checks
- ngx_http_integrity_helper Unix socket, suspicious cwpsrv helper processes and X-Ngx-Integrity strings in the server binary
3 sources
What people are saying
exceptionally stealthy
This indicates that the campaign was not merely experimental: real victims already exist in the wild,
Changing either the timestamp or the ciphertext independently invalidates the signature,