# MSP Threat Briefing: November 6, 2026

_November 6, 2026 · LNX Inc._

A hidden backdoor in Control Web Panel servers, fake AI event invites that steal work sessions, and Barracuda now says its ESG bypass needs no login.

No new entries on CISA's exploited list since November 4. The live threat today is a backdoor found on Control Web Panel hosting servers, which hides its own requests from the access logs. A phishing crew is also using fake OpenAI, SpaceX and Anthropic event invitations to take Microsoft 365 and Google sessions. Barracuda has corrected its advisory: the ESG bypass needs no login. Fixes also shipped for AuthPoint Gateway and for OpenSSH on Alpine.

1. On every CWP server, run the three checks in section 1. If any hit, restore the binary, rotate panel credentials and treat the host as compromised.
2. Block device code flow in Conditional Access for every tenant that does not need it. Search proxy and DNS logs for the event-phishing domains.
3. Confirm every Barracuda Email Security Gateway is on 9.4.0.030 or later. Keep its admin interface off the internet.
4. Upgrade AuthPoint Authentication Gateway to 7.6.0.
5. Update OpenSSH on Alpine and other musl-based hosts, or turn off SSH password logins.

## 1. Backdoored web server found on Control Web Panel hosts

QiAnXin XLab [published an analysis](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/) of CWPdoor, a backdoored copy of `cwpsrv`. That is the web server inside Control Web Panel (CWP), the free hosting panel once called CentOS Web Panel. XLab captured the installer script on June 29, 2026. A sample turned up on VirusTotal on September 30 alongside the Ebury Linux backdoor.

The script poses as a version update. It must run as root, and it replaces `/usr/local/cwpsrv/bin/cwpsrv` for versions 1.15.10 and 1.24.0. The backdoor stays silent until it receives a signed, encrypted command in custom HTTP headers. It edits the logging module so those requests never reach the access log. It also resets file timestamps and deletes shell history.

XLab says it does not yet know how attackers first get root on these hosts. Nothing in the report says CWP's own update channel was compromised. XLab counted more than 340,000 CWP instances exposed to the internet over the past month, as [reported by BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/).

**Who is exposed.** MSPs and small hosts that run client websites and email on CWP servers. Because the backdoor hides from access logs, a clean-looking log proves nothing.

**What to do.**

- Run XLab's three checks on every CWP server: `ss -axp | grep integrity`, `ps aux | grep cwpsrv` for unexpected helper processes, and `strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity`.
- Look for backup files named `cwpsrv.prev-` followed by a timestamp. The script leaves one when it swaps the binary.
- If a check hits, restore the legitimate binary, upgrade CWP, and confirm the socket check returns nothing.
- Rotate every control panel credential on an affected host. XLab says to treat them as compromised.
- Investigate the whole host. The root access came from somewhere, and Ebury was found with one sample.

Indicators published by [XLab](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/):

| Indicator | Type |
|---|---|
| `136.0.141[.]71` | Download server |
| `http://136.0.141[.]71/static/cwpsrv_update.sh` | Installer script URL |
| `e505d4ffa21cf494a5dc2d7c8f4f1236` | Installer script (MD5) |
| `965aea67fb40de1bab5169ada993349f` | cwpsrv 1.15.10 backdoor (MD5) |
| `d3f4e95113d49ab3991b45e457bda75b` | cwpsrv 1.24.0 backdoor (MD5) |
| `ngx_http_integrity_helper` | Unix socket |
| `X-Ngx-Integrity-Time`, `X-Ngx-Integrity-Data`, `X-Ngx-Integrity-Sig` | Command headers |

## 2. Fake AI event invitations steal Microsoft 365 and Google sessions

[Push Security reported](https://www.pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis) on November 5 a campaign using fake events from OpenAI, SpaceX and Anthropic. The invitations offer rewards such as three months of ChatGPT Pro for signing in with a work account. Links arrive through Google and Zapier short links. Earlier waves used GoTo Webinar senders and real Zoom event pages.

The event page offers "Continue with Microsoft" or "Continue with Google". The Microsoft path shows a device code. The victim enters it on Microsoft's real device login page, which hands tokens to the attacker. The victim then lands on a proxied Microsoft sign-in page that captures the password and session cookie. The Google path proxies the real sign-in and captures the password, MFA response and cookie.

Push names the tools: two event-page kits it calls ZoomMock and MSDRoot, the rented Kali365 device code service, and the rented VoidProxy adversary-in-the-middle proxy. MSDRoot pages appeared from October 22.

**Who is exposed.** Marketing, sales and leadership staff at any client, the people most likely to want free AI tools. Device code phishing gets past standard MFA, because the victim completes MFA on Microsoft's own page.

**What to do.**

- Block device code flow with a Conditional Access authentication flows policy. Exclude only the conference room and shared devices that need it.
- Review Entra sign-in logs for device code sign-ins by users who never use it.
- Move admins and high-risk users to phishing-resistant MFA, such as FIDO2 keys or passkeys.
- Tell staff that no real event asks them to enter a code or sign in with a work account to claim a prize.
- Search DNS and proxy logs for the indicators below. Push says the operator rotates domains every few weeks, so they matter most for looking back.

Indicators published by [Push Security](https://www.pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis) (the source lists more):

| Indicator | Type |
|---|---|
| `eventrsvp[.]app`, `openai.eventrsvp[.]app`, `spacex.eventrsvp[.]app` | Event pages |
| `rsvpconnect-events[.]com`, `anthropic.rsvpconnect-events[.]com` | Event pages |
| `217.60.102[.]48` | Collection server |
| `62zr4vcasl.shifts[.]icu`, `ydgjgdbhoa.shifts[.]icu` | Kali365 device code backend |
| `rnacj.iceagelandforms[.]surf`, `clqzwd4jqw.emptytownmoon[.]de` | Kali365 device code backend |
| `wbdssologin[.]app`, `login.wbdssologin[.]app`, `officegocrqb[.]com` | VoidProxy Microsoft proxy |
| `claudewebinnar[.]com`, `accounts.ggkiejl[.]icu`, `accounts.gfmzrsj[.]icu` | VoidProxy Google proxy |
| `logins-offcevents[.]icu` | Redirect |

## 3. Update: Barracuda now says the ESG bypass needs no login

Our [November 4 briefing](/news/msp-threat-briefing-2026-11-04/) said Barracuda listed both flaws as needing administrative access. On November 5, Barracuda [changed its advisory](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection). CVE-2026-116606 now reads "No (Administrative UI Access Required)". An attacker needs no account, only a route to the admin interface.

The same day, watchTowr published its analysis of the chain, as [reported by The Hacker News](https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html). Paired with CVE-2026-111560, the bypass gives root on the Email Security Gateway. watchTowr released a tool that checks whether an appliance is vulnerable, not an exploit. No exploitation has been reported, and neither flaw is on CISA's list.

**Who is exposed.** Clients with an Email Security Gateway below 9.4.0.030 whose admin interface is reachable from the internet or a broad internal network. Attackers have targeted ESG before, through CVE-2023-2868.

**What to do.**

- Confirm each ESG is on 9.4.0.030 or later. Install the patch by hand where automatic patching is off.
- Restrict the admin interface to trusted internal management networks.
- Patch the other five products for CVE-2026-111560. There it needs an administrator login.

## 4. WatchGuard AuthPoint Gateway: three critical flaws fixed in 7.6.0

WatchGuard published four advisories on November 4 for the AuthPoint Authentication Gateway. That is the on-premises component that links AuthPoint MFA to Active Directory, LDAP, RADIUS and ADFS. Every version from 1.0 up to 7.6.0 is affected. WatchGuard is not aware of any exploitation.

- [CVE-2026-121639](https://psirt.watchguard.com/CVE-2026-121639/), CVSS 9.2. An unauthenticated attacker who can reach the gateway can disrupt authentication and delete the directory sync configuration. Only LDAP or Active Directory setups are affected.
- [CVE-2026-121638](https://psirt.watchguard.com/CVE-2026-121638/), CVSS 9.1. Improper certificate validation lets an on-path attacker read and change traffic to RADIUS, LDAP or ADFS sources.
- [CVE-2026-121640](https://psirt.watchguard.com/CVE-2026-121640/), CVSS 9.1. A captured request between gateway components can be replayed to take administrative actions.
- [CVE-2026-121637](https://psirt.watchguard.com/CVE-2026-121637/), CVSS 8.9. An attacker with a valid header signature can forge LDAP authentication results.

**Who is exposed.** Clients that use AuthPoint MFA with on-premises directory sync or RADIUS for VPN and firewall logins. A gateway outage stops those logins.

**What to do.**

- Upgrade every AuthPoint Gateway to 7.6.0. WatchGuard lists no workaround.
- Limit which hosts can reach the gateway, and keep it off networks that guests and users share.

The same day, WatchGuard also published [WGSA-2026-0033](https://psirt.watchguard.com/WGSA-2026-0033/) for CVE-2026-98432, the Linux TCP flaw [covered on November 1](/news/msp-threat-briefing-2026-11-01/). SecurityWeek [reports](https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/) that Fireware and WatchGuard APs are not exposed to the exploit chain. Dimension has no patch yet.

## 5. OpenSSH 10.6p2 fixes a password bypass on Alpine and other musl systems

OpenSSH [released 10.6p2](https://www.openssh.org/releasenotes.html#10.6p2) on November 5. It works around a password authentication bypass on Linux systems that use musl libc with PAM disabled. Özgün Kültekin reported it. No CVE had been assigned when Alpine published, and no attacks have been reported.

Per [Alpine's advisory](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/), every condition must hold. The server runs without PAM, or with `UsePAM no`. Password logins are on, the default. One account has `*` as its password field, such as `root`, key-only users, or the `alpine` user on cloud images. And another local account has a `$5$` or `$6$` hash. An attacker who knows the passwordless account's name can then log in with an overlong password.

Alpine says the attack works every time with one connection. Glibc distributions such as Debian, Ubuntu and RHEL are not affected, and neither are PAM-based setups. OpenWrt's default Dropbear server is not affected.

**Who is exposed.** Alpine servers, containers and cloud images with SSH open, and appliances or routers built on Buildroot, Yocto or OpenWrt with OpenSSH added.

**What to do.**

- Run `apk upgrade openssh` and restart `sshd`. The running daemon is not replaced by the upgrade.
- Fixed Alpine packages include `10.3_p1-r2` on 3.24, `10.2_p1-r1` on 3.23, `10.0_p1-r11` on 3.22 and `9.9_p2-r1` on 3.21. Branches back to 3.16 also got fixes.
- If you cannot update, set `PasswordAuthentication no`. Confirm key login works first.
- Search `/var/log/messages` for "Accepted password for" on accounts that have no password. If you cannot rule a login out, Alpine says to treat the machine as compromised.

## Quick hits

**SonicWall GMS will not be fixed.** SonicWall disclosed two flaws on November 3 in Global Management System 9.5.2 and earlier, as [reported by The Hacker News](https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html). CVE-2026-109593, rated 9.1, is an unauthenticated file read. CVE-2026-109594, rated 6.8, is a SQL injection that needs a login. GMS is end of life, and SonicWall says no security update will be released. It points customers to Network Security Manager. Until the move, keep GMS off the internet.

**DigiCert breach.** DigiCert disclosed that an internal system exposed by a February 2025 server migration let outside accounts read archived customer records from June 27 to July 2, 2026, as [reported by BleepingComputer](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/). The data includes business contact details and, for some customers, ID documents submitted for validation. DigiCert says certificates, CertCentral and DigiCert ONE were not affected. Expect phishing aimed at certificate buyers, and watch for notification letters.

## Sources

- [QiAnXin XLab: CWPdoor, the invisible backdoor living inside Control Web Panel](https://blog.xlab.qianxin.com/cwpdoor-the-invisible-backdoor-living-inside-control-web-panel/)
- [BleepingComputer: hackers backdoor Linux servers using trojanized CWP web server](https://www.bleepingcomputer.com/news/security/hackers-backdoor-linux-servers-using-trojanized-cwp-web-server/)
- [Push Security: AI-themed fake event campaign analysis](https://www.pushsecurity.com/blog/ai-themed-fake-event-campaign-analysis)
- [BleepingComputer: fake OpenAI, SpaceX events used to steal Microsoft, Google accounts](https://www.bleepingcomputer.com/news/security/fake-openai-spacex-events-used-to-steal-microsoft-google-accounts/)
- [Barracuda: pre-authentication authorization bypass and command injection](https://trust.barracuda.com/security/pre-authentication-authorization-bypass-command-injection)
- [The Hacker News: experts demonstrate Barracuda Email Security Gateway chain](https://thehackernews.com/2026/11/experts-demonstrate-barracuda-email.html)
- [WatchGuard: CVE-2026-121639](https://psirt.watchguard.com/CVE-2026-121639/)
- [WatchGuard: CVE-2026-121638](https://psirt.watchguard.com/CVE-2026-121638/)
- [WatchGuard: CVE-2026-121640](https://psirt.watchguard.com/CVE-2026-121640/)
- [WatchGuard: CVE-2026-121637](https://psirt.watchguard.com/CVE-2026-121637/)
- [WatchGuard: WGSA-2026-0033](https://psirt.watchguard.com/WGSA-2026-0033/)
- [SecurityWeek: Cisco, WatchGuard release patches; SonicWall won't fix GMS flaws](https://www.securityweek.com/cisco-watchguard-release-patches-sonicwall-wont-fix-gms-flaws/)
- [OpenSSH: release notes for 10.6p2](https://www.openssh.org/releasenotes.html#10.6p2)
- [Alpine Linux: openssh-server password authentication bypass](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/)
- [The Hacker News: SonicWall won't patch EoL GMS flaws](https://thehackernews.com/2026/11/sonicwall-wont-patch-eol-gms-flaws-that.html)
- [BleepingComputer: DigiCert data breach exposes customer information, identity documents](https://www.bleepingcomputer.com/news/security/digicert-data-breach-exposes-customer-information-identity-documents/)