In a November 5 report, QiAnXin XLab describes CWPdoor, a backdoor compiled into Control Web Panel’s cwpsrv server.
XLab captured its deployment script on June 29, 2026. The script requires root access and replaces the server binary; it does not explain how attackers initially gain that access. Signed HTTP requests trigger command execution while bypassing access logging.
Samples target cwpsrv 1.15.10 and 1.24.0. These are observed malicious builds, rather than a confirmed vulnerable-version range. XLab cites a September VirusTotal submission as evidence of real infections, without establishing their scale.
Investigators should check for the ngx_http_integrity_helper socket and X-Ngx-Integrity strings in the binary. XLab recommends upgrading, rotating panel credentials and investigating the host for additional threats. Its report identifies no initial-access vulnerability or specific fixed version.
