cwpdoor

1 live · 1 on record · last incident 9 days ago

Dec ’25records per month, by first reportNov ’26

Live1

live
Control Web Panel Hackers backdoor Linux servers using trojanized CWP web server
Supply chain · Exploited · No fix needed · since 5 Nov 2026 · updated 6 Nov 2026
Threat actors are distributing a new Linux backdoor named CWPdoor via a trojanized version of the Control Web Panel web server. The malicious binary enables attackers to execute commands silently without generating logs.
Do:Check servers for unauthorized modifications to the cwpsrv binary and remove any instances of CWPdoor.

Nothing closed yet.