CWPdoor backdoor hides inside Control Web Panel servers, XLab says

CWPdoor backdoor hides inside Control Web Panel servers, XLab says

5 November 2026: Researchers at XLab, the threat lab of China's Qianxin, have described CWPdoor, a backdoor built into a recompiled copy of cwpsrv, the web server that runs the Control Web Panel hosting interface. It needs root to install, leaves no trace in the access logs and had no antivirus detections when XLab published on 5 November. XLab counts more than 340,000 Control Web Panel instances reachable from the internet.

Not yet independently verified. This rests on one research write-up, from XLab. We have not found a statement from the Control Web Panel developers, and nobody has yet said how the altered binary reaches servers. We will update this when it can be confirmed, and remove this note.

A replaced binary and a tidy install script

XLab's systems caught a script named cwpsrv_update.sh on 29 June 2026. It downloads an altered cwpsrv from a server at 136.0.141.71 and puts it in place of /usr/local/cwpsrv/bin/cwpsrv. It handles only two versions of the panel's server, 1.24.0 and 1.15.10, and it needs root.

The script then covers its tracks. It restores the original timestamps on the file and its directory, deletes its temporary files and removes its own lines from the shell history. If the panel fails a health check after the swap, it rolls the change back, so a broken install does not draw attention.

A door that opens only to a signed request

The backdoor is passive. cwpsrv is based on Nginx, and the altered build acts only on a request carrying three headers: X-Ngx-Integrity-Time, a timestamp accepted within 300 seconds either way; X-Ngx-Integrity-Data, a command encrypted with AES; and X-Ngx-Integrity-Sig, an RSA signature. The result comes back as an ordinary HTTP 200 response, and the request is left out of the logs.

Because the signature is checked, a scanner cannot find the backdoor by probing for it, and only the holder of the private key can use it.

Signs of real victims

XLab found a file uploaded to VirusTotal from Brazil on 30 September 2026 holding two samples: a library XLab identifies as the long-running Ebury backdoor, and a file named cwpsrv.suspeito that turned out to be CWPdoor, with zero detections. XLab reads this as a sign that the backdoor has been found on at least one real server, but says the link between the two families is unclear.

The 340,000 figure is exposure, counted on Qianxin's Hunter platform over the past month, not a count of infected servers.

Checks for hosting teams

There is no patched version to install, because the backdoor replaces the vendor's binary rather than exploiting a flaw in it. XLab suggests three checks on any server running the panel:

• ss -axp | grep integrity, looking for a socket named ngx_http_integrity_helper
• ps aux | grep cwpsrv, looking for unexpected helper child processes
• strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity

XLab gives the install script's MD5 as e505d4ffa21cf494a5dc2d7c8f4f1236 and the 1.15.10 sample's as 965aea67fb40de1bab5169ada993349f. Since installation needs root, a server where any check matches should be treated as fully compromised, with its credentials rotated, rather than cleaned by putting the original binary back. We list 201 web hosting companies, many of which run panels of this kind for customers.

XLab has asked anyone who knows how the altered binary is distributed to contact it.

Sources

• XLab (Qianxin): CWPdoor, the invisible backdoor living inside Control Web Panel, 5 November 2026, 5 November 2026
• iThome: report on CWPdoor, 10 November 2026, 10 November 2026