Researchers have found a trojanized version of Control Web Panel (CWP) — a free, widely used tool for managing Linux web hosting servers — quietly installing a backdoor on servers that run it. The malware, named CWPdoor, replaces CWP's own web server component, cwpsrv, with a tampered copy that looks and behaves like the real thing until an attacker sends it a specially crafted request.
Analysts at QiAnXin's XLab, who named and traced the threat, say the fake update first appeared as a shell script disguised as a routine version upgrade on 29 June 2026 and later surfaced on VirusTotal in September bundled with Ebury, a long-running malware family that has compromised close to 400,000 Linux servers since 2009, mostly by harvesting SSH credentials. CWPdoor itself stays dormant on a compromised server until the attacker sends an encrypted command hidden inside ordinary-looking HTTP headers, then executes it while deliberately suppressing the log entries that would normally record the activity. Researchers report that over 340,000 CWP instances are currently reachable on the public internet, and the installer specifically targets cwpsrv versions 1.15.10 and 1.24.0.
CWP is popular with budget and mid-tier hosting providers as a free alternative to commercial panels like cPanel or Plesk, which means it sits quietly underneath a large number of small-business websites, email servers, and client portals without the site owner ever knowing it's there.
What this means for your business
If you don't manage your own server, the first step is simply asking: does our hosting provider or the person who manages our server use Control Web Panel, and which version? Many small businesses never see their server's control panel directly — it's the host's or a contractor's tool — so this is a question worth putting to whoever holds that access this week, not a DIY check.
If your business (or your in-house IT contact) does run CWP directly: update to the latest release, and don't assume an unchanged cwpsrv binary is safe — compare it against a known-good copy or have your host do so, since the whole point of this backdoor is to look unremarkable. Rotate control-panel and SSH admin credentials regardless, since the installer has been found bundled with an SSH-credential-stealing tool. Because the backdoor is built to suppress its own log traces, don't rely on log review alone to rule out compromise; unusual outbound network activity is a more reliable signal than clean-looking logs.
More broadly, this is a reminder that the software quietly running "underneath" your website — the control panel, not the site itself — is still your attack surface, even when a host manages it day to day. It's worth knowing what that layer is before an incident forces the question.