Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

thehackernews.com Nov 6, 2026

Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

Curated by Shubham · TechCapsules · Nov 6, 2026

AI-summarised brief · reviewed before publication

Researchers at QiAnXin’s XLab discovered a backdoor embedded in the Control Web Panel (CWP) web server, a Linux hosting management tool. The malicious code, dubbed “cwpdoor,” replaces the legitimate cwpsrv binary for versions 1.15.10 and 1.24.0 and executes attacker‑supplied commands delivered via web requests that bypass access logs. Installation requires root privileges, indicating the attackers have already compromised the host. The backdoor masquerades as an update, restores file timestamps, and evades detection, showing zero hits on VirusTotal’s 63 scanners. A recent archive containing the payload was uploaded to VirusTotal from Brazil on September 30, suggesting active infections, though the exact number of compromised servers remains unknown. Researchers also noted the presence of the unrelated Ebury SSH backdoor in the same archive.

💡 Why It Matters

· The hidden backdoor lets intruders run commands without leaving traceable logs, giving them persistent, stealthy control over compromised Linux hosting environments.

Capsules Cybersecurity

Read full article on thehackernews.com

ZeroTier Partners With Redapt to Deliver Post-Quantum Networking

ZeroTier announced a partnership with Redapt to embed its ZeroTier Quantum platform into Redapt’s infrastructure, cloud and managed‑service portfolio. The solution uses post‑quantum cryptographic standards ML‑KEM‑1024 (FIPS 203) and ML‑DSA‑87 (FIPS 204) to protect connectivity across data‑center, cloud and edge environments. Redapt will assess, design, deploy and manage the platform for enterprise clients while also providing cybersecurity advisory and virtual CISO services to ZeroTier. Both firms target sectors such as government, defense, finance and regulated gaming, offering a turnkey path to quantum‑resilient networking without redesigning existing architectures. ZeroTier Quantum, the first end‑to‑end quantum‑secure networking platform, incorporates the ZeroTier Transport Protocol with hybrid FIPS‑compliant post‑quantum encryption and perfect forward secrecy. The collaboration also includes joint go‑to‑market campaigns and shared support resources.

💡 Enterprises can now adopt quantum‑grade protection today, sidestepping costly network overhauls and mitigating long‑term data‑exfiltration risks.

thehackernews.com · Nov 6

Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Security researchers disclosed a two‑stage attack against Barracuda’s Email Security Gateway appliance that grants unauthenticated attackers root privileges without logging in. The chain combines CVE‑2026‑116606, an authorization bypass that lets a remote user restore a crafted configuration backup and alter global settings, with CVE‑2026‑111560, a command‑injection flaw that normally requires an admin account but is enabled by the bypass. Together they allow arbitrary root‑level commands on the gateway. Barracuda issued firmware patches on Monday, fixing the gateway in version 9.4.0.030 and updating five related products for the injection issue. Mandiant rated the bypass 9.3/10 and the injection 8.6/10. WatchTowr released a detection tool but no public exploit, and the vulnerabilities are not listed in CISA’s KEV catalog as of today.

💡 The exploit proves that even well‑protected email gateways can be compromised without credentials, forcing organizations to reassess firmware update policies and validation of backup mechanisms.

thequantuminsider.com · Nov 6

QNu Labs Launches Corporate Training Programme on Quantum-Safe Security

QNu Labs has launched a 12‑hour corporate training programme through its QNu Academy, aimed at enterprise cybersecurity leaders. Backed by India’s National Quantum Mission, the three‑day course covers quantum key distribution, quantum random number generators, post‑quantum cryptography, cryptographic inventory management and emerging quantum threats. It targets CISOs, security strategists, risk and compliance officers, IT architects and senior security managers, offering assessment‑based certification and optional on‑site workshops for 15‑50 participants or half‑day executive briefings. Instructors include QNu engineers who have deployed quantum communications for banking, defence and secure systems, as well as professors from IITs, NITs, IIITs and IISERs. The programme seeks to equip organisations with the knowledge to assess quantum‑related risks and plan migration to quantum‑safe security for future resilience.

💡 Enterprises that ignore quantum‑ready cryptography risk having today’s encrypted data decrypted tomorrow, turning a strategic training investment into a defensive necessity.

thehackernews.com · Nov 6

Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services

Blockchain analytics firm Chainalysis disclosed that a sophisticated agentic cyber‑attack uncovered the names, usernames, password hashes and live tokens of every user on its platform. While the breach prompted the immediate shutdown of its Reactor, Data Solutions, Know‑Your‑Transaction (KYT) UI, API and address‑screening services, the company said no evidence shows that investigation data or attribution records were accessed or altered. Chainalysis has locked affected accounts, halted password resets and is requiring users to reset passwords and rotate API keys once trusted IPs are added to an allowlist. The incident follows a prior multi‑front attack that revealed a subset of passwords and mirrors a wave of AI‑driven assaults targeting tech firms, including the use of autonomous tools like ARTEX to harvest secrets from public code repositories.

💡 The breach exposes the entire credential base of a leading crypto‑forensics provider, forcing a rare full‑service outage and compelling customers to overhaul authentication across their own systems.

techcrunch.com · Nov 5

OpenAI released a new cybersecurity model. Is that enough?

Max Justicz, CTO of Charge Robotics, used OpenAI’s GPT‑5.6 Sol to uncover a severe vulnerability in Ubuntu’s code that could let attackers seize control of servers. The flaw, identified in two hours, was reported to the Debian Project, which promptly issued a patch. OpenAI announced a new cybersecurity‑focused model, ChatGPT Cyber, for its Daybreak Red program, noting it found 948 Linux kernel issues and 81 novel Firefox bugs. The company also pledged a $1 billion initiative to support critical‑infrastructure security researchers.

💡 The rapid discovery demonstrates how accessible AI can accelerate both defensive patching and potential exploitation, tightening the race between security teams and attackers.

thehackernews.com · Nov 5

Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

Cybersecurity researchers exposed a vulnerability that lets attackers bypass OpenAI’s ChatGPT Lockdown Mode, enabling silent data theft, phishing, and malware delivery. The flaw originates from HTML previews in code blocks that render within nested sandboxed frames. Attackers can escape the sandbox via pop‑ups, gaining unrestricted access to chat content and the user’s session. OpenAI patched the issue on September 18, 2026, but the discovery underscores that AI security hinges on the broader application environment.

💡 The breach shows that even robust AI safeguards can be undermined by peripheral features, forcing organizations to scrutinize the entire software stack when deploying AI tools.