Security notice

Running Control Web Panel (CWP)? Attackers are replacing cwpsrv with a silent backdoor. Check for CWPdoor and rotate panel credentials.

Last updated: Thursday, November 5, 2026, 5:30 PM ETStatus: Attacks reported by XLab. No CVE yet. Check your server now.

The software that runs your hosting panel can be swapped for a copy that quietly lets attackers in. Security researchers at XLab (QiAnXin) report CWPdoor, a hidden backdoor built into a tampered copy of cwpsrv, the web server behind Control Web Panel (CWP, formerly CentOS Web Panel). The fake binary looks and behaves like the real one, sits silent until an attacker sends it a secret signal, and hides that signal from your logs. There is no CVE and no patch to install for this, because it is not a bug in CWP: it is a replacement of CWP's own file on servers attackers have already reached. If you run CWP, check your server today. If you find it, replace cwpsrv with a clean copy, upgrade CWP, rotate every panel password and treat the server as compromised.

What happened

The backdoor. CWPdoor is a passive backdoor embedded in a trojanized rebuild of cwpsrv, the web server that powers the Control Web Panel interface. It does not call out to attackers. It waits for specially signed web requests, then runs commands through a helper process and keeps those requests out of the access logs. (XLab, BleepingComputer)
How it gets installed. XLab captured an infection script on June 29, 2026 that replaces legitimate cwpsrv versions 1.15.10 and 1.24.0 with the malicious binary, puts the original file timestamps back and wipes shell history to hide its tracks. How attackers first get onto the server is not known. (XLab)
Real victims exist. A file archive uploaded to VirusTotal from Brazil on September 30, 2026 contained the Ebury Linux malware alongside a copy of the CWPdoor binary, which no antivirus engine flagged at the time. That indicates real servers have been hit. How CWPdoor relates to Ebury is not clear. No count of infected servers has been published. (XLab, BleepingComputer)
How many servers could be targets. XLab's Hunter platform saw more than 340,000 CWP instances exposed to the internet in the past month. That is how many CWP panels are reachable, not how many are infected. (XLab)
No CVE yet. No CVE has been assigned in the coverage we checked through November 5, 2026. (XLab, BleepingComputer)
What we have not confirmed. EverThread has not confirmed any infections itself. This notice is based on the XLab report and BleepingComputer's coverage, both published November 5, 2026.

Who should worry

Anyone who runs, or has a host or agency running, Control Web Panel (CWP, formerly CentOS Web Panel) on a Linux server. This is hosting server software, not a website plugin: it affects the server that hosts your sites, and anyone who controls that server can reach every site, database and mailbox on it.

You manage your own VPS or dedicated server with CWP installed.
Your hosting company or agency uses CWP to run the server your sites are on. Ask them.
You run cwpsrv 1.15.10 or 1.24.0, the versions the infection script targets. Other versions are not proven safe; check anyway.

If no server you use runs Control Web Panel, this notice does not apply to you.

What to do now

Do these today. If you are not comfortable on a server command line, send the next section to whoever manages the server.

Look for the helper socket. XLab reports the backdoor uses a Unix socket named ngx_http_integrity_helper. As root, run ss -axp | grep integrity. Any result is a strong warning sign. (XLab)
Check the cwpsrv binary. Run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity. The real CWP web server should not contain X-Ngx-Integrity strings. (XLab)
Look at running cwpsrv processes. Check for unexpected cwpsrv helper processes that do not match a normal CWP install. (XLab)
If anything matches, replace cwpsrv with a clean copy. Attackers may leave a backup of the original named cwpsrv.prev-* in /usr/local/cwpsrv/bin; do not assume any file on the server is trustworthy. Get a clean copy from CWP and upgrade CWP. (XLab)
Rotate every panel credential. Change all CWP admin and user passwords and any keys used with the panel, from a clean machine. (XLab)
Treat the server as compromised. Hunt for other malware, including Ebury, which was found alongside CWPdoor. Many teams choose to rebuild an affected server from scratch. (XLab, BleepingComputer)

What to send your developer, agency or host

Please check every server we use that runs Control Web Panel (CWP) for CWPdoor, a backdoor in a trojanized cwpsrv binary reported by XLab on November 5, 2026. As root, check for the ngx_http_integrity_helper socket (ss -axp | grep integrity), run strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity, and look for unexpected cwpsrv helper processes. If anything matches: replace cwpsrv with a clean copy (do not trust any cwpsrv.prev-* backup), upgrade CWP, rotate all panel credentials, treat the server as compromised and hunt for other malware such as Ebury. There is no CVE yet. Please confirm what you found. Sources: XLab, BleepingComputer.

Common questions

Has my server been hacked?

This notice does not mean your server has been hacked. It means a stealthy backdoor for CWP servers is in use and you should check. Only the checks above, run on the server itself, can tell you.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We cannot see what hosting panel your server runs or what files are on it. A scan without a warning about this does not mean your server is clean.

Is there a patch?

Not in the usual sense. CWPdoor is not a flaw in CWP that a patch closes; it is a malicious replacement of CWP's own file. The fix on an affected server is a clean cwpsrv, an upgraded CWP, new credentials and a full check for other malware. How attackers first got in is not known, so keep CWP and the operating system up to date.

Are 340,000 servers infected?

No one has said that. XLab saw more than 340,000 CWP instances exposed to the internet in the past month. That is how many could be targets, not how many are infected. (XLab)

Where can I follow updates?

Read the XLab report and BleepingComputer coverage. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

XLab: "CWPdoor: the invisible backdoor living inside Control Web Panel", November 5, 2026; infection script captured June 29, 2026; VirusTotal sample September 30, 2026; Hunter platform exposure figure.
BleepingComputer: "Hackers backdoor Linux servers using trojanized CWP web server", November 5, 2026.