A backdoor named cwpdoor has been discovered in the Control Web Panel (CWP) server software, affecting versions 1.15.10 and 1.24.0. This backdoor allows attackers to execute commands on compromised systems without leaving traces in access logs.
The cwpdoor backdoor was first identified on June 29, 2026, when researchers captured a suspicious script named cwpsrv_update.sh. This script requires root privileges to operate, targeting specific versions of the cwpsrv binary.
The backdoor is embedded in the legitimate cwpsrv binary, which is modified to include malicious functionality. It is triggered by specially crafted HTTP requests containing encrypted commands and specific headers, while suppressing logging to avoid detection.
On September 30, 2026, a sample of the cwpdoor backdoor was uploaded to VirusTotal from Brazil, indicating real-world infections. More than 340,000 CWP instances were exposed to the internet in the month prior to the discovery.
Researchers have confirmed exploitation in the wild, although they have not yet determined how attackers gain initial root access to install the backdoor.