Someone is replacing the web server that runs the Control Web Panel admin interface with a backdoored copy, then covering the switch so the panel looks untouched. The implant, named CWPdoor by QiAnXin's XLab, runs attacker commands sent as signed HTTP headers and keeps those requests out of the access log. CWP 1.30.1, released on 3 November 2026, tightens the panel, but it does not clean a server that was already infected.
What happened
XLab captured the installer on 29 June 2026. It is a shell script called cwpsrv_update.sh that poses as a version update, downloads a matching build from a fixed IP address, and overwrites /usr/local/cwpsrv/bin/cwpsrv. It handles two builds only: cwpsrv 1.15.10 on EL7 and 1.24.0 on EL8 and EL9.
After the swap the script restores the original file and directory timestamps, deletes its temporary files and removes its own commands from shell history. The backdoored build had zero detections on VirusTotal when XLab checked. It stays silent until a request arrives with an encrypted command in X-Ngx-Integrity-Data, a timestamp in X-Ngx-Integrity-Time and an RSA signature in X-Ngx-Integrity-Sig inside a five minute window. Anything unsigned is served as normal traffic, so a scan from outside cannot tell an infected server from a clean one.
The evidence of real use is an archive uploaded to VirusTotal from Brazil on 30 September 2026. It held a backdoored cwpsrv next to libkeyutils.so.1.5.2, a library used by the Ebury SSH backdoor. XLab says the link between the two is unclear and that no infection count has been published.
Who is affected
- Any CWP server where an attacker has already had root, on either the CWP7 or CWPpro edition, since both run cwpsrv.
- EL7 hosts on cwpsrv 1.15.10 and EL8 or EL9 hosts on cwpsrv 1.24.0 from before CWP 1.29 moved the panel to Nginx 1.30.6.
- Hosting providers and resellers. XLab counted more than 340,000 CWP panels reachable from the internet in the past month. That is the pool of targets, not a count of infected machines.
What to do now
Run three checks as root on every CWP server, and treat any hit as full root compromise.
- strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity should return nothing.
- ss -axp | grep integrity must not list a socket named ngx_http_integrity_helper.
- ls -l /usr/local/cwpsrv/bin/cwpsrv.prev-* should show no file, though the installer deletes that backup when a swap succeeds.
- Close panel ports 2030, 2031, 2082, 2083, 2086, 2087 and 2304 to the internet and allow them only from admin addresses or a VPN.
- On a hit, rebuild or reinstall cwpsrv, update to CWP 1.30.1, rotate panel, root and hosting account passwords and SSH keys, and hunt for other malware. A clean file hash does not clear the host.
What this means for South African businesses
A large share of small local hosting and reseller accounts sit on CWP panels run by one or two people, and this backdoor hands over every site, mailbox, database and TLS key on that box. An SME whose website lives on such a host has no visibility into any of it, which is why the hosting contract and the provider's patch record deserve the same scrutiny as your own firewall. My read is that most South African SMEs would learn about this from a customer complaint or a blacklist notice, because nothing in the panel or its logs looks wrong.
Source: BleepingComputer, reporting XLab's technical analysis.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.