· 8 min read · LNX Inc.

MSP Threat Briefing: November 6, 2026

A hidden backdoor in Control Web Panel servers, fake AI event invites that steal work sessions, and Barracuda now says its ESG bypass needs no login.

A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn

No new entries on CISA's exploited list since November 4. The live threat today is a backdoor found on Control Web Panel hosting servers, which hides its own requests from the access logs. A phishing crew is also using fake OpenAI, SpaceX and Anthropic event invitations to take Microsoft 365 and Google sessions. Barracuda has corrected its advisory: the ESG bypass needs no login. Fixes also shipped for AuthPoint Gateway and for OpenSSH on Alpine.

  1. On every CWP server, run the three checks in section 1. If any hit, restore the binary, rotate panel credentials and treat the host as compromised.
  2. Block device code flow in Conditional Access for every tenant that does not need it. Search proxy and DNS logs for the event-phishing domains.
  3. Confirm every Barracuda Email Security Gateway is on 9.4.0.030 or later. Keep its admin interface off the internet.
  4. Upgrade AuthPoint Authentication Gateway to 7.6.0.
  5. Update OpenSSH on Alpine and other musl-based hosts, or turn off SSH password logins.

1. Backdoored web server found on Control Web Panel hosts

QiAnXin XLab published an analysis of CWPdoor, a backdoored copy of cwpsrv. That is the web server inside Control Web Panel (CWP), the free hosting panel once called CentOS Web Panel. XLab captured the installer script on June 29, 2026. A sample turned up on VirusTotal on September 30 alongside the Ebury Linux backdoor.

The script poses as a version update. It must run as root, and it replaces /usr/local/cwpsrv/bin/cwpsrv for versions 1.15.10 and 1.24.0. The backdoor stays silent until it receives a signed, encrypted command in custom HTTP headers. It edits the logging module so those requests never reach the access log. It also resets file timestamps and deletes shell history.

XLab says it does not yet know how attackers first get root on these hosts. Nothing in the report says CWP's own update channel was compromised. XLab counted more than 340,000 CWP instances exposed to the internet over the past month, as reported by BleepingComputer.

Who is exposed. MSPs and small hosts that run client websites and email on CWP servers. Because the backdoor hides from access logs, a clean-looking log proves nothing.

What to do.

  • Run XLab's three checks on every CWP server: ss -axp | grep integrity, ps aux | grep cwpsrv for unexpected helper processes, and strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity.
  • Look for backup files named cwpsrv.prev- followed by a timestamp. The script leaves one when it swaps the binary.
  • If a check hits, restore the legitimate binary, upgrade CWP, and confirm the socket check returns nothing.
  • Rotate every control panel credential on an affected host. XLab says to treat them as compromised.
  • Investigate the whole host. The root access came from somewhere, and Ebury was found with one sample.

Indicators published by XLab:

IndicatorType
136.0.141[.]71Download server
http://136.0.141[.]71/static/cwpsrv_update.shInstaller script URL
e505d4ffa21cf494a5dc2d7c8f4f1236Installer script (MD5)
965aea67fb40de1bab5169ada993349fcwpsrv 1.15.10 backdoor (MD5)
d3f4e95113d49ab3991b45e457bda75bcwpsrv 1.24.0 backdoor (MD5)
ngx_http_integrity_helperUnix socket
X-Ngx-Integrity-Time, X-Ngx-Integrity-Data, X-Ngx-Integrity-SigCommand headers

2. Fake AI event invitations steal Microsoft 365 and Google sessions

Push Security reported on November 5 a campaign using fake events from OpenAI, SpaceX and Anthropic. The invitations offer rewards such as three months of ChatGPT Pro for signing in with a work account. Links arrive through Google and Zapier short links. Earlier waves used GoTo Webinar senders and real Zoom event pages.

The event page offers "Continue with Microsoft" or "Continue with Google". The Microsoft path shows a device code. The victim enters it on Microsoft's real device login page, which hands tokens to the attacker. The victim then lands on a proxied Microsoft sign-in page that captures the password and session cookie. The Google path proxies the real sign-in and captures the password, MFA response and cookie.

Push names the tools: two event-page kits it calls ZoomMock and MSDRoot, the rented Kali365 device code service, and the rented VoidProxy adversary-in-the-middle proxy. MSDRoot pages appeared from October 22.

Who is exposed. Marketing, sales and leadership staff at any client, the people most likely to want free AI tools. Device code phishing gets past standard MFA, because the victim completes MFA on Microsoft's own page.

What to do.

  • Block device code flow with a Conditional Access authentication flows policy. Exclude only the conference room and shared devices that need it.
  • Review Entra sign-in logs for device code sign-ins by users who never use it.
  • Move admins and high-risk users to phishing-resistant MFA, such as FIDO2 keys or passkeys.
  • Tell staff that no real event asks them to enter a code or sign in with a work account to claim a prize.
  • Search DNS and proxy logs for the indicators below. Push says the operator rotates domains every few weeks, so they matter most for looking back.

Indicators published by Push Security (the source lists more):

IndicatorType
eventrsvp[.]app, openai.eventrsvp[.]app, spacex.eventrsvp[.]appEvent pages
rsvpconnect-events[.]com, anthropic.rsvpconnect-events[.]comEvent pages
217.60.102[.]48Collection server
62zr4vcasl.shifts[.]icu, ydgjgdbhoa.shifts[.]icuKali365 device code backend
rnacj.iceagelandforms[.]surf, clqzwd4jqw.emptytownmoon[.]deKali365 device code backend
wbdssologin[.]app, login.wbdssologin[.]app, officegocrqb[.]comVoidProxy Microsoft proxy
claudewebinnar[.]com, accounts.ggkiejl[.]icu, accounts.gfmzrsj[.]icuVoidProxy Google proxy
logins-offcevents[.]icuRedirect

3. Update: Barracuda now says the ESG bypass needs no login

Our November 4 briefing said Barracuda listed both flaws as needing administrative access. On November 5, Barracuda changed its advisory. CVE-2026-116606 now reads "No (Administrative UI Access Required)". An attacker needs no account, only a route to the admin interface.

The same day, watchTowr published its analysis of the chain, as reported by The Hacker News. Paired with CVE-2026-111560, the bypass gives root on the Email Security Gateway. watchTowr released a tool that checks whether an appliance is vulnerable, not an exploit. No exploitation has been reported, and neither flaw is on CISA's list.

Who is exposed. Clients with an Email Security Gateway below 9.4.0.030 whose admin interface is reachable from the internet or a broad internal network. Attackers have targeted ESG before, through CVE-2023-2868.

What to do.

  • Confirm each ESG is on 9.4.0.030 or later. Install the patch by hand where automatic patching is off.
  • Restrict the admin interface to trusted internal management networks.
  • Patch the other five products for CVE-2026-111560. There it needs an administrator login.

4. WatchGuard AuthPoint Gateway: three critical flaws fixed in 7.6.0

WatchGuard published four advisories on November 4 for the AuthPoint Authentication Gateway. That is the on-premises component that links AuthPoint MFA to Active Directory, LDAP, RADIUS and ADFS. Every version from 1.0 up to 7.6.0 is affected. WatchGuard is not aware of any exploitation.

  • CVE-2026-121639, CVSS 9.2. An unauthenticated attacker who can reach the gateway can disrupt authentication and delete the directory sync configuration. Only LDAP or Active Directory setups are affected.
  • CVE-2026-121638, CVSS 9.1. Improper certificate validation lets an on-path attacker read and change traffic to RADIUS, LDAP or ADFS sources.
  • CVE-2026-121640, CVSS 9.1. A captured request between gateway components can be replayed to take administrative actions.
  • CVE-2026-121637, CVSS 8.9. An attacker with a valid header signature can forge LDAP authentication results.

Who is exposed. Clients that use AuthPoint MFA with on-premises directory sync or RADIUS for VPN and firewall logins. A gateway outage stops those logins.

What to do.

  • Upgrade every AuthPoint Gateway to 7.6.0. WatchGuard lists no workaround.
  • Limit which hosts can reach the gateway, and keep it off networks that guests and users share.

The same day, WatchGuard also published WGSA-2026-0033 for CVE-2026-98432, the Linux TCP flaw covered on November 1. SecurityWeek reports that Fireware and WatchGuard APs are not exposed to the exploit chain. Dimension has no patch yet.

5. OpenSSH 10.6p2 fixes a password bypass on Alpine and other musl systems

OpenSSH released 10.6p2 on November 5. It works around a password authentication bypass on Linux systems that use musl libc with PAM disabled. Özgün Kültekin reported it. No CVE had been assigned when Alpine published, and no attacks have been reported.

Per Alpine's advisory, every condition must hold. The server runs without PAM, or with UsePAM no. Password logins are on, the default. One account has * as its password field, such as root, key-only users, or the alpine user on cloud images. And another local account has a $5$ or $6$ hash. An attacker who knows the passwordless account's name can then log in with an overlong password.

Alpine says the attack works every time with one connection. Glibc distributions such as Debian, Ubuntu and RHEL are not affected, and neither are PAM-based setups. OpenWrt's default Dropbear server is not affected.

Who is exposed. Alpine servers, containers and cloud images with SSH open, and appliances or routers built on Buildroot, Yocto or OpenWrt with OpenSSH added.

What to do.

  • Run apk upgrade openssh and restart sshd. The running daemon is not replaced by the upgrade.
  • Fixed Alpine packages include 10.3_p1-r2 on 3.24, 10.2_p1-r1 on 3.23, 10.0_p1-r11 on 3.22 and 9.9_p2-r1 on 3.21. Branches back to 3.16 also got fixes.
  • If you cannot update, set PasswordAuthentication no. Confirm key login works first.
  • Search /var/log/messages for "Accepted password for" on accounts that have no password. If you cannot rule a login out, Alpine says to treat the machine as compromised.

Quick hits

SonicWall GMS will not be fixed. SonicWall disclosed two flaws on November 3 in Global Management System 9.5.2 and earlier, as reported by The Hacker News. CVE-2026-109593, rated 9.1, is an unauthenticated file read. CVE-2026-109594, rated 6.8, is a SQL injection that needs a login. GMS is end of life, and SonicWall says no security update will be released. It points customers to Network Security Manager. Until the move, keep GMS off the internet.

DigiCert breach. DigiCert disclosed that an internal system exposed by a February 2025 server migration let outside accounts read archived customer records from June 27 to July 2, 2026, as reported by BleepingComputer. The data includes business contact details and, for some customers, ID documents submitted for validation. DigiCert says certificates, CertCentral and DigiCert ONE were not affected. Expect phishing aimed at certificate buyers, and watch for notification letters.

Sources

threat-briefingmanaged-it

More from LNX

All posts →
A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: November 5, 2026 A Zyxel GS1900 switch flaw was exploited as a zero-day, CISA lists an Apple flaw used in watering-hole attacks, and mSecure warns its users. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: November 4, 2026 Stolen app credentials are reaching client tenants through MSP apps, cPGuard updates shipped a backdoor, and CISA lists the WordPress core upgrade flaw. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: November 3, 2026 A backdoored Claude Code extension hit the Cursor marketplace, Red Hat ships kernels for the critical TCP flaw, and Android fixes a zero-click RCE. Read the post →

Tell us what's in front of you.

A drawing set, a failing switch, an audit deadline, or a hunch that IT costs too much. We'll tell you who picks it up and what it takes.

Request a quote Book an assessment (833) 569-5690 · Mon–Fri 8–4