Qianxin’s XLab says a backdoor it calls cwpdoor has been replacing the web server binary inside Control Web Panel, an open-source Linux server management panel, and that a sample uploaded to VirusTotal had a zero detection rate.
XLab’s threat analysis system captured an update script named cwpsrv_update.sh on 29 June 2026. The script downloads a modified copy of cwpsrv, the web server that serves the panel’s interface, from a remote host and swaps it in for the original. XLab says the script resets file timestamps and clears the shell history, so a routine listing makes the file look untouched. It supports cwpsrv versions 1.24.0 and 1.15.10.
The backdoor is passive. XLab says it behaves like the legitimate server until it receives a specially signed HTTP request, runs the command inside, and leaves that request out of the access log. On 30 September a file archive uploaded to VirusTotal from Brazil held the cwpdoor sample next to a file most vendors identified as the Ebury backdoor. cwpdoor had a zero detection rate. XLab says that points to real victims and that the link between the two families is unclear.
Why it matters
XLab cites data from QiAnXin’s Hunter platform showing more than 340,000 Control Web Panel instances exposed to the internet over the past month, all potential targets. XLab does not know how the backdoor spreads. Because the tampered server leaves its own requests out of the log, the checks have to run on the host.
What to do
In our reading, hosting teams should take the panel’s management port off the public internet, as our opinion piece on management interfaces argues. XLab’s host checks are to look for a Unix socket named ngx_http_integrity_helper, unexpected helper processes under cwpsrv, and the string X-Ngx-Integrity inside the binary. For an infected host XLab advises replacing the binary with the legitimate backup it says the attacker leaves in /usr/local/cwpsrv/bin, upgrading, rotating every control panel credential and treating the host as compromised. We covered another Linux backdoor in Fortinet’s ClingSTUN report.
Source: Qianxin XLab, CWPdoor: The Invisible Backdoor Living Inside Control Web Panel
