Control Web Panel: backdoor hidden in panel web server runs attacker commands

What happened

On 6 November 2026, researchers reported a backdoor hidden in the web server of Control Web Panel (CWP), a hosting panel for Linux servers. The backdoor executes commands that attackers send through web requests, and it does so without leaving entries in the access logs. This makes it hard to spot with normal log review.

This is not a vulnerability that can be fixed with a patch. Installing the backdoor requires root access, so any server where it is found has already been fully compromised. The backdoor is used to keep that access and to run further commands later.

Who is affected

At risk are operators of Linux servers that run Control Web Panel, in particular hosting providers and agencies that manage CWP servers for customers. A server only carries the backdoor if an attacker has already gained root on it. The source report does not say how the attackers obtained root access in the first place, so every CWP server should be checked.

What to do now

1. Make sure Control Web Panel and the operating system are fully updated, so known weaknesses cannot be used to gain access again.
2. Restrict access to the panel's web interface: allow it only from trusted IP addresses through the firewall or a VPN, and do not expose it to the whole internet.
3. Check each CWP server as described in the next section. Because the backdoor does not write access log entries, do not rely on the web server logs alone.
4. If you find signs of compromise, treat the server as untrusted. Take a copy of the evidence, then rebuild the server from a clean installation and restore only data (websites, databases, mail), not system files or binaries, from backups made before the compromise.
5. After a compromise, change all credentials that were stored on or used with the server: root and user passwords, SSH keys, panel accounts, database passwords, mail accounts and API keys. Inform affected customers where required.
6. Review backups and other servers that share credentials or SSH keys with an affected machine, as attackers with root may have moved on.

How to check whether you are affected

The report does not publish specific file names or indicators, so check the following on every CWP server and compare with the vendor guidance linked below:

• Verify the integrity of installed packages and system binaries, for example with rpm -Va on RHEL-based systems, and look for changed files that belong to the panel's web server or core system tools.
• Compare the panel's web server files with those of a freshly installed, known-good CWP server of the same version, or with checksums from the vendor where available.
• Look for unexpected processes started by the panel's web server and for unusual outbound network connections (ps auxf, ss -tunap).
• Review authentication logs for root logins or SSH access from unknown addresses, and check /root/.ssh/authorized_keys and the keys of other users for entries you did not add.
• Check crontabs, systemd units and other startup locations for entries you do not recognise.
• If you use external monitoring of outbound traffic or file integrity, review it for changes since the server was last known to be clean.

If you cannot rule out a compromise with confidence, rebuilding the server is the safer choice, since an attacker with root can hide traces on the system itself.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://thehackernews.com/2026/11/hackers-hide-linux-backdoor-in-control.html