Source: thehackernews.com
Researchers at QiAnXin's XLab discovered a backdoor embedded in the web server component of Control Web Panel (CWP), a widely used free hosting management panel for Linux servers. The backdoor allows attackers to execute arbitrary commands via crafted web requests, with the malicious traffic intentionally excluded from the server's access logs, making detection extremely difficult. Installation of the backdoor requires root-level access, indicating that the threat actors had already fully compromised the target systems prior to planting it. The stealthy nature of the implant — combining command execution capability with log evasion — suggests a sophisticated, persistent threat actor. CWP is used by a large number of Linux hosting providers, potentially widening the attack surface. The backdoor represents a significant supply-chain-style risk for server administrators relying on CWP. No specific CVE has been mentioned in the article. The incident highlights the ongoing targeting of server management software as a vector for persistent access.
