- Qianxin XLab found cwpdoor, a backdoor hidden inside the web server of Control Web Panel. It runs attacker commands and keeps those requests out of the logs.
- XLab's data shows more than 340,000 exposed CWP instances. Its evidence of real victims is one archive uploaded from Brazil.
- Check for the socket and strings XLab lists. Do not treat file dates or access logs as proof that a host is clean.
The witness is the suspect
Many routine checks, such as file dates, command history and access logs, ask a server to report on itself. All of that evidence comes from the machine under inspection. A report from Qianxin XLab on a backdoor it calls cwpdoor shows what happens when the attacker controls the program that writes those records. The lesson here is that a log is testimony. Testimony from a compromised witness proves little.
What XLab found
On June 29, 2026, XLab's threat-analysis system caught a script named cwpsrv_update.sh. The script fetches a file, also called cwpsrv, from the address 136.0.141.71. It then swaps that file in for the real one on the machine.
cwpsrv is the web server for Control Web Panel (CWP). CWP is a free, open-source tool that lets administrators manage websites, DNS and email through a graphical screen instead of the command line. It runs on CentOS and other Linux systems.
XLab used data from QiAnXin's Hunter Platform, which counted over 340,000 CWP instances reachable from the internet in the past month. XLab calls all of them potential targets. That is a count of exposure, not of infections.
The evidence of real victims is narrower. An archive named evidencia.tgz reached VirusTotal from Brazil on September 30, 2026. XLab says it held a cwpdoor file that no security vendor detected. It also held the Ebury backdoor, which most vendors did flag. XLab says the link between the two is unclear. Different attackers may have planted them on the same server.
How the backdoor works
cwpdoor is not a separate program. XLab found that the attacker added malicious code to the cwpsrv source and then built a new copy. The result behaves like a normal panel server until a specific request arrives. Security researchers call this a passive backdoor.
The trigger is an HTTP request carrying three special headers. One holds a timestamp. One holds a command encrypted with AES, a standard encryption method. One holds an RSA digital signature, which proves the sender holds the attacker's private key.
The backdoor accepts the request only if the timestamp falls within 300 seconds of the current time and the signature checks out. Anything else is handled as ordinary web traffic. Because the signature covers the timestamp and the command together, changing either one breaks it.
If the checks pass, the command goes to a helper process through a local channel called a Unix domain socket, named ngx_http_integrity_helper. The result comes back encrypted, inside an HTTP 200 response whose content type is application/octet-stream, which marks it as binary data.
The backdoor then changes how that one request is recorded. XLab says it swaps the pointer the server uses to reach its logging module, so the request never appears in the access log. Think of a door that opens only for one cut key and also tears out the visitor book.
Built to look untouched
The installer script is written with the same care. XLab describes it as a tool for only two cwpsrv versions, 1.24.0 and 1.15.10, and it needs root access. It backs up the original file and stops the service. It then overwrites /usr/local/cwpsrv/bin/cwpsrv and restarts the service. If the health check fails, it rolls back. If the install succeeds, XLab describes the script as deleting its temporary files and the backup.
Whether it succeeds or fails, it restores the file's original timestamps and the parent folder's timestamp. It also deletes the session's command history. XLab says that ordinary checks such as ls and stat would show the swapped file as never changed. The script then reports the result to 136.0.141.71.
What nobody knows yet
XLab is open about its limits. It does not know which vulnerability cwpdoor uses to spread. It cannot say whether Ebury and cwpdoor are connected. It captured two samples, one for each supported version. The company has asked peers with visibility into this activity to share leads.
Questions for your team
First, do we run Control Web Panel anywhere? Include forgotten servers and hosts managed by third parties, and ask whether the panel is reachable from the internet.
Second, can someone run XLab's three checks this week? XLab lists ss -axp | grep integrity to look for the helper socket. It also lists ps aux | grep cwpsrv to look for suspicious helper processes. For the third, XLab suggests running strings on /usr/local/cwpsrv/bin/cwpsrv and filtering for X-Ngx-Integrity, which finds the header names inside the program file.
Third, if a host matches, what is the plan? XLab recommends restoring the backup the attacker left in /usr/local/cwpsrv/bin, named cwpsrv.prev followed by a date and time. The installer is described as deleting that backup on success, so it may not exist. In that case, reinstall a known-good cwpsrv from the vendor. XLab also recommends upgrading to the latest version and confirming the socket check comes back empty. It says to rotate every control panel credential and treat the host as compromised.
Finally, do our reviews lean on file dates and access logs as proof of a clean host? cwpdoor was built to defeat exactly those. When the program that keeps the records is the intruder, a quiet log is not evidence of a quiet server.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Qianxin XLab.
