Attackers are replacing cwpsrv, the web server behind the free hosting panel Control Web Panel (CWP), with a backdoored copy, according to researchers at XLab, part of QiAnXin. The backdoor, named cwpdoor, stays dormant until it receives a signed request, then runs the attacker’s command and keeps that request out of the access logs. XLab published its analysis on November 5, and how the attackers get onto servers is still unknown.

XLab’s count of CWP instances exposed to the internet over the past month is more than 340,000, and it describes all of them as potential targets. That is not a count of infected servers, and the report does not give one or name any victims. Its evidence of real use is an archive uploaded to VirusTotal from Brazil on September 30, which held cwpdoor alongside the Ebury Linux backdoor. XLab notes that the link between the two is unclear, and they may have been planted by different attackers. ESET reported in May 2024 that Ebury had compromised almost 400,000 servers over about 15 years, with its operators gaining full access to large servers at ISPs and well-known hosting providers.

The Backdoor Replaces the Panel’s Own Web Server

Cwpdoor is not a separate program. The attackers add code to the cwpsrv source, recompile it and replace the legitimate file, so the server behaves normally until a crafted request arrives. Commands travel encrypted in HTTP headers, with an RSA signature and a time window of 300 seconds either way. XLab reports that the cwpdoor file had zero antivirus detections on VirusTotal, while most vendors flagged the Ebury file in the same archive.

The installer XLab captured on June 29 poses as a version update, downloads the file from a remote server and supports cwpsrv versions 1.24.0 and 1.15.10. It restores the timestamps of the replaced file and its folder, and clears the session’s command history. The report does not say that CWP’s own update channel was involved. The installer also has to run as root, and XLab does not yet know how attackers get that access or which vulnerability cwpdoor uses to spread. CISA’s catalog of exploited flaws lists two older CWP command injection bugs, CVE-2025-48703, added in November 2025, and CVE-2022-44877, added in January 2023, but XLab does not link either to this campaign.

LiteSpeed Patches Critical HTTP/3 Flaw Ahead of November 16 Disclosure

How Administrators Can Check a CWP Server

CWP is most often installed on an unmanaged VPS, according to InMotion Hosting, which also offers the panel on its managed VPS plans. CWP publishes a list of partner hosts that offer servers with it installed and supported. XLab’s report does not identify any affected hosting providers.

Access logs will not show the trigger requests, so XLab points to checks on the server itself:

  • Socket: look for the Unix socket ngx_http_integrity_helper with ss -axp | grep integrity.
  • File: look for the backdoor’s header names with strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity.
  • Process: look for suspicious helper child processes with ps aux | grep cwpsrv.

These checks target known cwpdoor indicators, so a clean result does not rule out other variants or threats. If a server is infected, XLab advises putting back a legitimate copy of the file, upgrading CWP and confirming that the socket check returns nothing. It also advises rotating all control panel credentials and treating the host as compromised.

CWP’s changelog shows that version 1.29, released on October 31, moved cwpsrv to nginx 1.30.6, from the same 1.24.0 and 1.15.10 versions the installer supports. Version 1.30.1, a security and stability update, followed on November 3. The changelog does not mention cwpdoor or describe either release as a fix for it, and XLab treats upgrading as only one step of the cleanup.