Hello,
On 2026-11-08 at 18:21 (EET), I ran "Update CWP now" from the admin panel on a CWP 1.30.4 server (AlmaLinux 8.10). The update log shows the cwpsrv updater downloading a new binary from the IP published by XLab as the CWPdoor download server:
Downloading http://136.0.141.71/static/cwpsrv_1.30.6_almalinux8.10
sha256 : 2d21c2caf032e367 -> e99898e600df97f7
size : 6320200 -> 6574304 bytes
mtime : 2026-10-31 00:07:26 (preserved)
reported : http://136.0.141.71/update?v=1.30.6
log file : none (this updater writes no files)
The replaced binary has SHA256 e99898e600df97f78d17720a548199990b2174a61a75ba1e1afb198ee6e28f5c. The original binary from the cwpsrv-1.30.6-1.el8 RPM was 2d21c2caf032e3677a8727b33f83a2487448fb5d59c6766cf2034d82c6cc8d8b.
No local file on the server references 136.0.141.71, and /etc/hosts is clean. The update chain was /scripts/update_cwp → cron.php → the "cwpsrv UPDATER" script, which was fetched and executed without being saved to disk. This suggests the CWP update infrastructure may be serving a malicious updater.
Actions taken: blocked the IP, stopped cwpsrv, preserved the evidence, rolled the VM back to a snapshot taken before the update, verified the clean binary, disabled the nightly CWP cron, and changed the root password.
Please confirm whether your update infrastructure is compromised and when it is safe to update again. I can provide the binary for analysis.