Security researchers have found a stealthy Linux backdoor hidden inside trojanised software used to run the Control Web Panel hosting interface.

Named CWPdoor, it was disclosed on 5 November by XLab, the cybersecurity arm of Chinese firm QiAnXin Technology Group. It targets cwpsrv, the web server behind Control Web Panel (CWP), a free panel formerly known as CentOS Web Panel, widely used on low-cost servers.

A fake update swaps the real server binary

Researchers first captured the attack on 29 June in a script posing as a software updater, cwpsrv_update.sh. The script checked the installed version, downloaded a matching malicious file, stopped the real service and replaced the legitimate cwpsrv binary. Modified builds targeted versions 1.15.10 and 1.24.0.

The swap was hidden: the script restored file timestamps, deleted temporary files and wiped the command-history log. XLab said more than 340,000 CWP instances had been exposed to the internet over the preceding month — a measure of potential exposure, not a count of infected machines.

Silent until a signed request wakes it

CWPdoor stays dormant until a specially crafted HTTP or HTTPS request arrives carrying a timestamp, an AES-encrypted command and an RSA signature in a header named X-Ngx-Integrity-Data. It then runs the attacker's command and suppresses the matching access-log entry, leaving almost no trace.

A sample uploaded to VirusTotal from Brazil on 30 September was detected by no security products. The researchers said its link to the Ebury backdoor found in the same archive is unclear, and they have not identified who is behind the campaign.

There is no CVE for CWPdoor and no patch to apply. Administrators should hunt for the ngx_http_integrity_helper socket and suspicious cwpsrv helper processes. This is separate from the batch of ten CWP vulnerabilities disclosed on 2 November.

Sources: BleepingComputer, Hackers backdoor Linux servers using trojanized CWP web server, 5 November 2026; Abijita, CWPdoor Control Web Panel Linux backdoor, 5 November 2026; Zot.news, Stealthy CWPdoor backdoor targets Control Web Panel servers, 5 November 2026; primary research: QiAnXin XLab, 5 November 2026.