QiAnXin XLab reports Linux backdoor hidden in Control Web Panel web server
QiAnXin's XLab researchers say a backdoor has been found in the web server that runs Control Web Panel, a free Linux hosting panel.
Written by a model from the sources below. Verify against them.
- Vendor
- Control Web Panel
- Product
- Control Web Panel (CWP)
- Status
- Reported, not confirmed
- Disclosed
Summary
The backdoor executes commands sent through web requests without leaving entries in access logs, and installing it requires root access.
What to do
Check CWP servers for unfamiliar binaries, processes, or web server files.
Review root access logs and rotate all credentials on affected hosts.
Update Control Web Panel to the latest version and follow vendor guidance.
Rebuild any host where the backdoor is confirmed from known-good media.
Timeline
- Made public by The Hacker News
- First seen by cve.now
- Posted on X by cve.now
Evidence 1
- PressThe Hacker News
“The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the Control Web Panel breach
Was Control Web Panel breached?
The Hacker News reports it. No statement from Control Web Panel has reached cve.now yet.
What should Control Web Panel customers do?
Check CWP servers for unfamiliar binaries, processes, or web server files. Review root access logs and rotate all credentials on affected hosts. Update Control Web Panel to the latest version and follow vendor guidance. Rebuild any host where the backdoor is confirmed from known-good media.