Critical

Hackers backdoor Linux servers using trojanized CWP web server

BleepingComputer

November 5, 2026 at 4:24 PM

Actively Exploited

Overview

A new piece of malware named CWPdoor is targeting Linux servers by exploiting a compromised version of cwpsrv, the web server component of the Control Web Panel (CWP). This malware allows attackers to gain unauthorized access to systems, potentially compromising sensitive data and server integrity. Users of CWP should be particularly vigilant, as the trojanized web server can lead to significant security breaches. The incident raises concerns about the security of open-source software and the importance of downloading software from trusted sources. Companies using CWP are urged to review their server configurations and ensure they are not using the affected version of the software.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Control Web Panel (CWP), cwpsrv web server
Action Required: Users should ensure they are using the official version of CWP and check for any security updates or patches.
Timeline: Newly disclosed

Original Article Summary

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]

Impact

Control Web Panel (CWP), cwpsrv web server

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should ensure they are using the official version of CWP and check for any security updates or patches. It is advisable to audit server configurations and monitor for any suspicious activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, Malware, Trojan.

Read Original Article

Related Coverage

MetaMask says recent attack didn't affect wallet infrastructure

BleepingComputer

MetaMask, a popular cryptocurrency wallet provider, has addressed concerns regarding a recent security incident. The company stated that despite the incident, there was no impact on MetaMask wallets or their underlying infrastructure. This reassurance comes as users often worry about the security of their digital assets. MetaMask's prompt communication aims to alleviate fears and maintain user trust in their services. It's critical for cryptocurrency platforms to ensure their systems are secure, especially given the rise in cyberattacks targeting digital wallets.

Nov 6, 2026

Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services

The Hacker News

Chainalysis, a blockchain analysis firm, has disclosed that a recent cyber attack compromised the credentials of all its users. During their investigation, the firm found that names, usernames, password hashes, and live tokens were exposed. In response, Chainalysis has temporarily shut down access to its Reactor and Data Solutions services while they continue to assess the situation. Thankfully, the company stated there is no current evidence that sensitive investigation data has been accessed. This breach raises significant concerns about user security and the potential misuse of exposed credentials, emphasizing the need for robust security measures in the industry.

Nov 6, 2026

Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

The Hacker News

Researchers have identified two vulnerabilities in Barracuda's Email Security Gateway that could allow attackers to gain root access without needing to log in. The first flaw, known as CVE-2026-116606, is an authorization bypass, which lets unauthorized users execute commands on the device. Barracuda issued patches for these vulnerabilities on Monday, following the detailed reporting by the security firm watchTowr on Thursday. This is concerning because root access grants full control over the email-filtering appliance, potentially compromising sensitive communications. Organizations using this gateway should prioritize applying the patches to secure their systems against potential exploitation.

Nov 6, 2026

FBI, CISA warn of cyberattacks targeting refrigeration systems

BleepingComputer

The FBI and CISA have issued a warning about cyberattacks targeting industrial refrigeration and cold-chain monitoring systems across the globe. These attacks pose serious risks, including food spoilage, equipment damage, and potential fire hazards. Hackers have been exploiting vulnerabilities in these systems, which are critical for preserving perishable goods. Companies in the food and beverage industry, as well as those reliant on temperature-sensitive products, need to be vigilant. The consequences of these attacks can lead to significant financial losses and safety concerns, making it essential for organizations to enhance their cybersecurity measures.

Nov 6, 2026

US Government Email Systems Open to Abuse Thanks to Typos

darkreading

A recent analysis reveals that typos in Domain Name System (DNS) records can expose U.S. government email systems to potential abuse by attackers. Erroneous or outdated DNS entries may allow malicious actors to hijack email communications, giving them unauthorized access to sensitive information. This issue affects various government agencies that rely on these email systems for secure communications. The implications are serious, as compromising government email could lead to data breaches and undermine public trust. Organizations must ensure their DNS records are accurate and up-to-date to mitigate these risks.

Nov 5, 2026

Nearly 1.5 million exposed secrets targeted in new revocation program

BleepingComputer

Truffle Security has initiated the Secrets Revocation Program, aimed at addressing the issue of publicly exposed API keys and secrets. This program is designed to help organizations revoke approximately 1.4 million secrets that are still valid and have been exposed online. The initiative is free and seeks to protect companies from potential data breaches by allowing them to manage and secure their sensitive information more effectively. With so many API keys at risk, this program is a significant step towards enhancing security practices in the tech industry. Companies that rely on APIs need to take advantage of this opportunity to safeguard their systems and prevent unauthorized access.

Nov 5, 2026