# SZB-97fd8de188: QiAnXin XLab reports Linux backdoor hidden in Control Web Panel web server

QiAnXin's XLab researchers say a backdoor has been found in the web server that runs Control Web Panel, a free Linux hosting panel.

- Type: Breach
- Status: Reported, not confirmed
- Vendor: Control Web Panel
- Product: Control Web Panel (CWP)
- Disclosed: 2026-11-06 05:58 UTC
- Sources: 1 distinct
- First seen by cve.now: 2026-11-06 07:04 UTC · Updated: 2026-11-06 07:10 UTC

> No statement or filing from Control Web Panel has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

The backdoor executes commands sent through web requests without leaving entries in access logs, and installing it requires root access.

## What to do

- Check CWP servers for unfamiliar binaries, processes, or web server files.
- Review root access logs and rotate all credentials on affected hosts.
- Update Control Web Panel to the latest version and follow vendor guidance.
- Rebuild any host where the backdoor is confirmed from known-good media.

## Timeline

- 2026-11-06 05:58 UTC: Made public by The Hacker News
- 2026-11-06 07:04 UTC: First seen by cve.now
- 2026-11-06 07:05 UTC: [Posted on X by cve.now](https://x.com/i/status/2118600585414869432)

## Evidence (1 source)

- 2026-11-06 · Press · [The Hacker News](https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html): “The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-97fd8de188&body=https%3A%2F%2Fcve.now%2FSZB-97fd8de188%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the Control Web Panel breach

### Was Control Web Panel breached?

The Hacker News reports it. No statement from Control Web Panel has reached cve.now yet.

### What should Control Web Panel customers do?

Check CWP servers for unfamiliar binaries, processes, or web server files. Review root access logs and rotate all credentials on affected hosts. Update Control Web Panel to the latest version and follow vendor guidance. Rebuild any host where the backdoor is confirmed from known-good media.

## Related

- Started as early warning SZB-97fd8de188, first seen 2026-11-06 07:04 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-97fd8de188
Site guide for agents: https://cve.now/llms.txt