{
  "id": 18459058,
  "title": "Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs",
  "url": "https://urgent.news/2026/11/06/hackers-hide-linux-backdoor-in-control-web-panel-server-to-execute",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-06T05:58:54.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html"
  },
  "original_language": "en",
  "account": "A hidden backdoor discovered in the Control Web Panel (CWP) web server for Linux hosting servers, as reported by researchers at QiAnXin's XLab, allows attackers to execute commands without leaving any trace in access logs. The malicious installer, masquerading as a version update, requires root access to infect the server. The backdoor, named cwpdoor, was first noticed on June 29, when an archive containing it was uploaded to VirusTotal from Brazil, suggesting the presence of real victims. The researchers have not yet determined how attackers gain the necessary root access. The backdoor integrates with the cwpsrv program, a legitimate control web panel, until it receives a request with a specific timestamp and signature in custom headers. Upon receiving such a request, the backdoor executes the command contained within it. The installation process replaces the cwpsrv file with its original dates, making it appear unaltered when checked using common command-line tools. Out of 63 detections on VirusTotal, the backdoor had zero detections, highlighting its evasive capabilities. The researchers recommend three steps to mitigate the threat: first, identify and remove the backdoor if a server is infected; second, ensure proper access controls to prevent root access; and third, monitor for the presence of the Ebury malware, another backdoor, which may have been planted alongside cwpdoor on the same server by different attackers.",
  "summary": "A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}