CWP2Shell: a ten-vulnerability chain roots more than 118,000 Control Web Panel hosts
On November 3, 2026, VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP) that chain from an unauthenticated request to a root shell, with 118,000 instances observed online. Hosting providers should move to version 1.29 and take ports 2083, 2031, and 2087 off the public internet.