---
id: "CMP-202611-2hvaws"
kind: "campaign"
aliases: []
title: "Backdoored Control Web Panel server (cwpdoor): attackers swap the CWP panel binary cwpsrv for a copy that runs their commands and hides them from logs (XLab)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Control Web Panel", "fixed": [], "affected": "cwpsrv 1.15.10, 1.24.0 (binary replaced)", "ecosystem": "linux"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-05T16:35:04+00:00"
updated_at: "2026-11-05T16:35:39+00:00"
sources: [{"source": "analyst", "url": "https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/", "first_seen_at": "2026-11-05T16:35:04+00:00", "cites": ["https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/"]}]
exploit_sources: []
---

# Backdoored Control Web Panel server (cwpdoor): attackers swap the CWP panel binary cwpsrv for a copy that runs their commands and hides them from logs (XLab)

Attackers with root on Control Web Panel (CWP, formerly CentOS Web Panel) servers run a fake 'update' script (cwpsrv_update.sh) that replaces /usr/local/cwpsrv/bin/cwpsrv with a recompiled backdoored build (cwpdoor) for cwpsrv 1.15.10 and 1.24.0. The backdoor wakes only on an RSA-signed HTTP request carrying X-Ngx-Integrity-* headers, runs the encrypted command, and drops the request from access logs; the script also resets file timestamps and wipes shell history. XLab first saw the script on 29 Jun 2026; a victim sample was uploaded to VirusTotal from Brazil on 30 Sep 2026 alongside the Ebury backdoor, so real servers are infected. Antivirus detection was zero. How attackers first get in is unknown (recent CWP flaws CVE-2026-73695 and related are a plausible but unconfirmed route). XLab counts about 340,000 internet-exposed CWP instances.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- linux:Control Web Panel affected cwpsrv 1.15.10, 1.24.0 (binary replaced) fixed no fixed version listed

## How to check

- On CWP servers run: ss -axp | grep integrity  (a Unix socket named ngx_http_integrity_helper means infected)
- strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity  (any match means infected)
- ps aux | grep cwpsrv for unexpected helper child processes
- Files named cwpsrv.prev-YYYYMMDD-HHMMSS in /usr/local/cwpsrv/bin (the attacker's backup of the real binary)
- MD5: e505d4ffa21cf494a5dc2d7c8f4f1236 (cwpsrv_update.sh), 965aea67fb40de1bab5169ada993349f (cwpsrv_1.15.10), d3f4e95113d49ab3991b45e457bda75b (cwpsrv_1.24.0)
- Network/proxy logs for 136.0.141[.]71, including http://136.0.141[.]71/static/cwpsrv_update.sh, /static/cwpsrv_1.15.10, /static/cwpsrv_1.24.0
- File timestamps are reset by the script, so do not rely on ls/stat dates

## Fix

- If infected: restore the real binary from the cwpsrv.prev-* backup, upgrade CWP to the latest release, and confirm ss -axp | grep integrity returns nothing
- Rotate all control panel, root and SSH credentials; treat the host as fully compromised and look for other implants (Ebury was found next to cwpdoor)
- Block 136.0.141.71
- Upgrade all CWP servers to the latest release (fixes the 2026 CWP RCE chain) and restrict panel ports to trusted IPs

## Timeline

- 2026-11-05T16:35:04+00:00 analyst https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/

## Documents

- [describes] @BleepinComputer: Hackers backdoor Linux servers using trojanized CWP web server
https://t.co/zkhS https://x.com/BleepinComputer/status/2118378984064860614
- [describes] CWPdoor: The Invisible Backdoor Living Inside Control Web Panel (XLab) https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_