A Backdoor Is Hiding Inside the Web Server That Runs Control Web Panel. It Takes Commands Through Request Headers, Leaves No Access-Log Entry, and Scanned Clean on VirusTotal.
If you run Control Web Panel, log in to the server and run ss -axp | grep integrity. A result naming ngx_http_integrity_helper means the panel's web server, cwpsrv, has been replaced with a backdoored build. XLab, QiAnXin's research team, named it cwpdoor. Two more checks: look at the processes with ps aux | grep cwpsrv for helper processes you cannot account for, and run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity. A match on that string is a second sign. If any check hits, treat the host as compromised, because the backdoor runs arbitrary commands.
What XLab found
XLab captured an installer script on June 29, 2026, named cwpsrv_update.sh. It is disguised as a version update and only handles two versions of the panel's web server, 1.15.10 and 1.24.0. It must run as root, so the attacker already controls the server. XLab does not know how they get that access.
The script checks the local version, downloads the matching binary from 136.0.141.71, confirms the version, backs up the original, stops the service, overwrites /usr/local/cwpsrv/bin/cwpsrv, restarts it and checks that the master, worker and helper processes are running. If that check fails, it rolls back. If it succeeds, it deletes the temporary files and the backup. Either way, it puts the new binary's access and modification times, and its parent directory's, back to their original values and deletes the session's shell history. Ordinary ls and stat checks show a file that was never touched. It also reports the result back to the same address.
How the backdoor works
cwpsrv is Control Web Panel's own web server, a customized build of Nginx. The attacker did not drop separate malware. They added code to its source and recompiled it. Until a trigger arrives it behaves like the real server.
The trigger is an HTTP or HTTPS request with three custom headers whose names begin with X-Ngx-Integrity: a timestamp, an AES-encrypted command, and an RSA signature over the two. The server checks the timestamp against a window of 300 seconds either side, and checks the signature against a public key embedded in the binary. If either fails, the request is handled as ordinary traffic. If both pass, the command goes to a helper process over a Unix socket, the result comes back encrypted in an HTTP 200 with content type application/octet-stream, and the request is left out of the access log.
Two consequences matter for defenders. The signature means nobody else can use the door, so scanning for it by sending your own request will not work. And the missing log entry means your web logs cannot tell you whether it was used.
How many could be affected
XLab cites QiAnXin's Hunter platform for more than 340,000 Control Web Panel instances exposed to the internet over the past month. That is the number of potential targets, not infected servers. XLab gives no count of infections.
There is one sign of real victims. On September 30, 2026, an archive named evidencia.tgz was uploaded to VirusTotal from Brazil. It held a file named cwpsrv.suspeito, which is cwpdoor, with zero detections, and a library named libkeyutils.so.1.5.2, which most vendors identified as the Ebury backdoor. XLab says the relationship between Ebury and cwpdoor is unclear and the two may have been planted on the same server by different attackers.
What to do
- Run the three checks above on every Control Web Panel server, including ones you consider internal.
- If one is infected, XLab's steps are: replace cwpsrv with the backup the installer made in /usr/local/cwpsrv/bin, named cwpsrv.prev- followed by a date and time; upgrade to the latest version and confirm the socket check no longer matches; and rotate all control panel credentials. Note that XLab's own description says the installer deletes the backup on success, so you may have none. Reinstall from a clean source if so.
- Treat the host as compromised and look for other implants. XLab itself says Ebury turned up beside it in at least one case.
- Block 136.0.141.71 at the egress and ingress of hosts that run the panel, and search logs for connections to it from at least June 29.
- Do not leave the panel's port open to the internet. The attacker already needs root to install this, so the front door is a separate problem, but a management plane facing the whole internet adds to the exposure and is not required for most setups.
The last two items are our reading of the situation, not XLab's.
What we hold
The three file hashes and the downloader address are published by XLab. We already held them from a TweetFeed ingest on November 5, as unattributed third-party records, which is not a lead and we do not claim one. We have now added them under their own campaign source, manual-batch-cwpdoor-2026-11, attributed to the cwpdoor family, at confidence 85 for the hashes and 80 for the address. The hashes are: e505d4ffa21cf494a5dc2d7c8f4f1236 for the installer script, 965aea67fb40de1bab5169ada993349f for the backdoored cwpsrv 1.15.10 and d3f4e95113d49ab3991b45e457bda75b for 1.24.0. The address sits on a VPS in the Netherlands (AS149440). We have not established whether it is attacker-owned or a compromised machine, and XLab does not say.
What is not known
How attackers get the root access the installer needs. Who is behind it. How many servers are infected. Whether Ebury is part of the same operation. The report publishes no domains, and the signing key it shows is the attacker's public key, not a secret.
Limits
We read XLab's report and The Hacker News's summary. We did not obtain or run any sample, and we did not test the checks on a server. Command output can differ between distributions. Detection of the sample may have changed since XLab's zero-of-63 result.
Five percent of this is wrong somewhere. It always is. If you find a variant or a second installer version, tell us.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.