CyberPulse Cybersecurity News, with Source Links
FA
The Hacker News

Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.

Malware & Threats Operating Systems
Read the full article at The Hacker News Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →
The Hacker News

Chainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services

Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed

Data Breach Blockchain & Web3
Source
NCSC Netherlands

NCSC-2026-0469 [1.00] [M/H] Kwetsbaarheid verholpen in OpenSSH door OpenSSH Project

Het OpenSSH project heeft een kwetsbaarheid verholpen in sshd van OpenSSH versies ouder dan 10.6p2. De kwetsbaarheid treft Linux systemen die gebruikmaken van musl libc en waarop PAM niet wordt gebruikt. De kwetsbaarheid betreft een bypass van de SSH-wachtwoordauthenticatie bij gebruik van wachtwoorden met een lengte van 257 tot 1024 bytes. De oorzaak ligt in de interactie tussen de authenticatieafhandeling van OpenS…

Operating Systems
Source
The Hacker News

Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a

Vulnerabilities & Zero-Day
Source