Malware · 3h ago
BleepingComputer reports that CWPdoor, a Linux backdoor, is being distributed through a trojanized version of cwpsrv, the web server behind Control Web Panel (CWP).
The attackers tamper with the server component rather than relying on access through CWP’s management interface. When compromised cwpsrv runs, it can install the backdoor; keeping the panel off the public internet therefore does not establish that a host is clean.
That shifts the trust boundary from the visible management panel to the software component serving it. For hosting providers with CWP installations, a panel-exposure inventory alone can miss affected servers; the reporting does not establish how broadly the trojanized cwpsrv has been distributed.
2 sources covering this story
Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs
CWPdoor replaces Control Web Panel's web server after root access, enabling command execution through requests hidden from access logs.
Hackers backdoor Linux servers using trojanized CWP web server
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.
Part of the PlainSec briefing for 2026-11-06