Hackers backdoor Linux servers using trojanized CWP web server

# Hackers backdoor Linux servers using trojanized CWP web server

https://gcdradar.vercel.app/incidents/hackers-backdoor-linux-servers-using-trojanized-cwp-web-serv · AIR-2026-1800 · live

- Lane: Supply chain
- Severity: 3 (Confirmed exploitation): Confirmed real-world exploitation via trojanized software installations.
- Fix status: No fix needed
- First reported: 2026-11-05
- AI role: No AI role
- Products: Control Web Panel, cwpsrv

## Summary

Threat actors are distributing a new Linux backdoor named CWPdoor via a trojanized version of the Control Web Panel web server. The malicious binary enables attackers to execute commands silently without generating logs.

## What to do

Check servers for unauthorized modifications to the cwpsrv binary and remove any instances of CWPdoor.

## Affected and fixed versions

- Affected: Control Web Panel cwpsrv

## Latest updates

- 2026-11-06: Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs (https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html)
- 2026-11-05: Hackers backdoor Linux servers using trojanized CWP web server (https://bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server)

## Sources

- 2026-11-05 BleepingComputer: Hackers backdoor Linux servers using trojanized CWP web server https://bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server
- 2026-11-06 The Hacker News: Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.