Researchers at QiAnXin’s XLab have discovered a covert Linux backdoor named cwpdoor that targets Control Web Panel servers by replacing the cwpsrv web server executable. According to a technical analysis published on November 6, 2026, the malicious modification allows threat actors to execute arbitrary commands via custom HTTP headers while intentionally omitting those specific requests from the server access logs, making unauthorized activity significantly harder to detect through standard log analysis.

The discovery sheds light on sophisticated methods attackers use to maintain persistent, stealthy access to administrative Linux environments. Control Web Panel is widely utilised for managing web hosting infrastructure, making compromised servers highly lucrative targets for malicious actors seeking deep access to underlying hosting architectures and hosted customer sites.

According to the technical findings, installing the cwpdoor backdoor requires initial root access to the target machine. An installer script for the backdoor was captured on June 29, posing deceptively as a version update shell script. This script explicitly handles two specific versions of the cwpsrv web server, namely 1.15.10 and 1.24.0, replacing the legitimate binary with a rebuilt executable containing extra malicious code.

The modified cwpsrv program listens for incoming web requests featuring a valid timestamp and signature within custom headers starting with X-Ngx-Integrity to trigger command execution. Furthermore, the installer modifies the replaced file modification dates back to original values so standard checks using basic utilities like ls and stat show no alterations. When researchers checked the backdoor file on VirusTotal, it registered zero detections out of 63 engines, and a separate archive uploaded from Brazil on September 30 also contained the Ebury malware, although researchers remain unsure if the two threats are directly related.

This stealthy approach presents severe risks for server administrators and hosting providers because traditional auditing methods fail to reveal the tampering. Because the malicious requests are omitted from access logs and file timestamps are manipulated to match original values, routine administrative oversight will frequently miss ongoing intrusions, leaving vulnerable servers exposed to extended unauthorised control.

Defending against such advanced file replacement backdoors requires thorough integrity monitoring of system binaries beyond basic file metadata checks. Administrators managing Control Web Panel environments should maintain strict access controls, monitor for anomalous socket activity, and utilise advanced endpoint detection tools capable of identifying binary tampering that evades traditional signature scanners and file modification date verification.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news