Backdoor found inside Control Web Panel's own web server

Researchers at QiAnXin's XLab found the implant in the server that runs CWP, a free panel widely used to manage Linux hosting boxes.

Linux hostingBackdoor

Updated 9 Nov 2026

Researchers at QiAnXin's XLab found the implant in the server that runs CWP, a free panel widely used to manage Linux hosting boxes.

What to do

Check exposure this week and follow the vendor or investigator guidance in the source report.

Original reporting: The Hacker News

Members analysis

The full attack chain, detection ideas and hardening steps for this story are for Velkrypt Wire members.

Become a member I already have an account

Original reporting: The Hacker News

Discussion

0 comments

Get the Weekly Wire

The week's exploited vulnerabilities and breaches, in one email.

More Threats

MediumThreats6 Nov 2026

Fake security tools on GitHub push backdoors and infostealers

Repositories posing as security utilities are being used to infect the people most likely to download them: researchers and defenders.

GitHubInfostealer

Cybersecurity News roundup

MediumThreats5 Nov 2026

Remote hacks warm supermarket fridges; French blood bank site hit

Retailers in several European countries reported refrigeration systems tampered with remotely. A separate attack on a French blood bank site did not affect blood products.

OTCritical infrastructure

SecurityWeek

HighThreats3 Nov 2026

Backdoor turned 1.3 million Android TV boxes into a criminal botnet

Manufacturer Videostrong planted the backdoor in set-top boxes and sold criminals access to the resulting network.

BotnetAndroidIoT

Malwarebytes Labs