[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fysg9RbIADJyvZ4o10YdnZUirhi78FQitqLo9Bi_74V8":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"8006c1f6-749c-4b7b-9d7f-16d0f11754ba","Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs","hackers-hide-linux-backdoor-in-control-web-panel-server-to-execute-commands-with-97fd8d","A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.","Researchers have discovered a backdoor embedded within the Control Web Panel (CWP) web server, a popular tool for managing Linux hosting. This backdoor allows attackers to execute commands remotely without leaving any trace in the server's access logs. The attackers require root access to install the backdoor, indicating they must have already compromised the server.","Hackers hide Linux backdoor in Control Web Panel server to execute commands without logs.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fhackers-hide-linux-backdoor-in-control.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjsAMxBevh2cmz1buKWukyP6JgUHrIPcr9zrJjAs1OwDoP1wMjn_s_WKHeUAdSwVzTImUsDE0C3SLGEpciaLk9H8CGvqiYugQWASsflB1a5zA9Wyr4RbroT3Z3JlOeak1AEinAy7Brf9N0BRDuGFWdZC23nCrOq4VuSMQQuDFYBYC6YCEm2ncPhHOv3KXs\u002Fs1600\u002Fcwp.jpg","2026-11-06T05:58:54+00:00","2026-11-06T08:00:20.617358+00:00",7,[17,20,23],{"name":18,"type":19},"Control Web Panel","product",{"name":21,"type":22},"Linux","technology",{"name":24,"type":25},"QiAnXin","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":30,"value":46,"context":47},"CWP backdoor","Backdoor found in Control Web Panel web server",[24,18],{"controls":50,"vendors":136},[51,79,108],{"slug":52,"name":53,"problem":54,"products":55},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[56,63,71],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":58,"url":61,"description":62},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":80,"name":81,"problem":82,"products":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[84,92,100],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":109,"name":110,"problem":111,"products":112},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[113,120,128],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":115,"url":118,"description":119},"tenzir","Tenzir","\u002Fvendor-logos\u002Ftenzir.png","tenzir-platform","https:\u002F\u002Ftenzir.com\u002F","Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-lake","Cribl Lake","https:\u002F\u002Fcribl.io\u002Fproducts\u002Flake\u002F","Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"linux-backdoor-in-cwp-server-evades-logs-via-root-access-abuse","Linux Backdoor in CWP Server Evades Logs via Root Access Abuse","Attackers embedded a backdoor into the Control Web Panel (CWP) server that enables remote command execution without generating access log entries, effectively blinding defenders to malicious activity. The attack requires root access as a prerequisite, meaning the server was already compromised before the backdoor was installed — highlighting a failure in both access control hardening and ongoing monitoring. The ability to execute commands without leaving log traces is especially dangerous because incident responders lose the forensic trail needed to understand the breach scope. This incident underscores that log integrity and completeness are as critical as the logs themselves — if an attacker can operate outside the logging framework, detection becomes nearly impossible. Organizations relying solely on access logs for threat detection are left exposed when those logs can be bypassed.",[142,143,144,145,146,147,148],"CIS Control 8: Audit Log Management","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1070: Indicator Removal","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":150,"CIS Control 8: Audit Log Management":151,"MITRE ATT&CK T1070: Indicator Removal":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"CIS Control 6: Access Control Management":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 requires incident handling and monitoring controls sufficient to detect anomalous activity; a backdoor that suppresses logs represents a direct failure of the monitoring obligations mandated under this article.","The backdoor's core capability was evading access logs; centralized, tamper-resistant log management required by this control would have preserved evidence and triggered alerts for log gaps or anomalies.","The backdoor's ability to execute commands without leaving access log entries is a direct implementation of indicator removal on the host, which this ATT&CK technique documents and for which specific detections should be developed.","Timely patching and integrity verification of the CWP software would reduce the window in which attackers could exploit weaknesses to gain the root access needed to deploy the backdoor.","Root access was required to install the backdoor, meaning stricter privileged access controls — such as just-in-time access and MFA for root — could have prevented the initial privilege abuse.","Regular vulnerability assessments of hosting management software like CWP, combined with integrity checks, would surface embedded or modified components before they can be weaponized.","Enforcing least-privilege access and strong authentication for administrative interfaces like CWP would limit an attacker's ability to obtain the root privileges required to install the backdoor."]