Hackers backdoor Linux servers using trojanized CWP web server
A trojanized build of the Control Web Panel server binary ('CWPdoor') is being used to backdoor Linux hosts — a supply-chain risk for hosting providers and any enterprise relying on CWP for server management.
Summary written by editorial AI · Source link below
A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]
Editorial Analysis
Compromised server-management software offers attackers persistent, privileged access to entire hosting environments, potentially affecting many downstream tenants.
Audit any CWP installations for binary integrity and monitor for C2 traffic patterns associated with CWPdoor.
A backdoored Linux hosting panel threatens managed infrastructure — verify supply-chain integrity of server-management tools.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at BleepingComputer in a new tab.
More from the Threat Intel Desk
- Hackers pull off $133 million French bank heist via service provider2d
- Fake security tools on GitHub push backdoors and infostealers3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 45 (2026)3d
- CEO-spoofing scammers used AI to help steal more than $100 million, feds say3d
- Chainalysis says breach exposed credentials for all customers3d