Stealthy CWPdoor Backdoor Lets Attackers Hide Commands on Linux Servers Running Control Web Panel
Researchers have detailed a backdoor called CWPdoor that targets Linux servers running Control Web Panel. It lets attackers send commands through crafted HTTP requests while keeping those requests out of normal access logs, making detection significantly harder for administrators.
Security researchers are warning about a covert backdoor, dubbed CWPdoor, that targets Linux servers using Control Web Panel and allows attackers to run commands through specially crafted web traffic without appearing in standard access logs.
According to reporting cited in The Hacker News, CWPdoor is installed on servers running Control Web Panel, a web‑based management interface for Linux hosting environments. Once present, the backdoor listens for particular HTTP requests chosen by the attacker.
When it receives one of these crafted requests, CWPdoor can execute commands on the underlying server. The design of the malware aims to keep those trigger requests out of ordinary access logs, which are often the first place administrators look for signs of compromise.
By hiding in the management layer of a server, CWPdoor gives intruders a quiet way to maintain control. Systems that rely heavily on log reviews and automated log analysis may miss this activity if they don’t know what to look for.
The reporting reviewed so far does not identify who is behind CWPdoor or how widespread infections are. It also doesn’t specify exactly how the backdoor is initially deployed onto vulnerable servers.
Key signals to watch include public advisories from the Control Web Panel project, detection guidance from security vendors, and any follow‑up research tying CWPdoor to a particular threat actor or long‑running campaign.
Sources
- OSINT