Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.

GSocket is a legitimate open-source remote access tool that is being exploited by multiple threat actors to remain undetected even after the vulnerabilities used to gain entry have been patched. As a result of this activity, attackers are developing independent access channels that remain active after the initial security breach, highlighting the growing post-compromise threat.  Microsoft released a report on November 11, 2026 detailing malicious use of GSocket across Linux environments in significant numbers. Microsoft Defender for Endpoint telemetry reports a 356.2% increase in detections of GSocket-related attacks between March and August 2026. The attacks primarily affected internet-facing web applications as well as hosting infrastructure.  As a networking utility, GSO sockets were originally developed to allow remote communication between systems behind firewalls and Network Address Translation (NAT) devices. As a result of these networking capabilities, attackers are establishing encrypted command-and-control connections via GSRNV through the Global Socket Relay Network in an attempt to exploit its capabilities.  In contrast to conventional remote access methods, GSocket does not require attackers to directly access compromised servers. By establishing outbound connections to the shared relay network, both the infected host and the operator are able to communicate. In addition to eliminating the need for an exposed inbound port, a public IP address, or a dedicated C2 server controlled by an attacker, this communication model also diminishes conventional network defense capabilities.  A firewall rule that identifies inbound connections cannot easily identify these connections, and blocking individual IP addresses or domains may not interfere with access as traffic passes through a shared relay system. However, egress filtering and outbound traffic monitoring can be useful for identifying or preventing suspicious communications.  Most detected activities occur in web hosting environments An analysis conducted by Microsoft determined that web applications and hosting environments contributed 87.1% to the number of incidents attributed to GSocket. PHP web applications and cPanel hosting accounted for 63.9% of incidents, while Apache environments contributed 24.3%. In conclusion, these findings indicate that internet-facing Linux infrastructure is a significant target of this activity.  GSocket is typically downloaded and launched through shell commands by attackers using vulnerabilities in exposed web applications. Once deployed, the tool operates independently of the vulnerable application. As a result, patching the original security flaw or restarting the affected service does not terminate or remove the malicious client or terminate its access channel automatically. According to Microsoft, education and research organizations accounted for 30.7% of affected organizations, followed by technology and telecommunications with 22.9%.  Attackers Establish Multiple Persistence Mechanisms Following the initial compromise, Microsoft found that attackers used a number of methods to maintain GSocket running. These malicious processes were renamed in order to appear to be legitimate Linux kernel threads or system services, which made them less noticeable during routine system checks. In some cases, hidden files were also installed in temporary or memory-backed directories to facilitate the deployment process.  There were some intrusions involving watchdog processes and duplicate copies of the tool, which enabled access to be restored if one instance was removed. Persistence was established by cron jobs, systemd services, and shell startup files. As part of their efforts to complicate investigations, attackers also deleted installation files and other traces of deployment.  Moreover, the research identified attempts to exploit the Linux kernel vulnerability CVE-2026-43284, commonly referred to as Dirty Frag, which can allow attackers to elevate their privileges from a web-service account to root. This was observed in a limited number of incidents, but success in escalation of privilege was not always observed.  Shared relay network complicates blocking GSocket identifies and authenticates its endpoints utilizing a shared secret rather than a fixed IP address. During installation, a secret is generated and made available to the operator in a variety of ways. By using that information, the attacker can connect to the compromised server using a client that is compatible with the Global Socket Relay Network, regardless of the network address of the compromised server changing.  Consequently, conventional IP-based blocking is less reliable due to the shared relay infrastructure, rather than controlled by a single attacker. Therefore, blocking an attacker's address may not interrupt the connection, which makes conventional IP-based blocking less reliable. Nevertheless, Microsoft stated that monitoring outbound traffic and imposing egress restrictions remain useful methods of identifying or limiting such activity.  A host-level investigation and remediation is recommended by Microsoft GSocket activity should be treated as a host compromise, rather than assuming that patching the vulnerable application will resolve the issue. Security teams should locate and eliminate unauthorized GSocket clients, staged files, and persistence mechanisms, as well as check whether suspicious outbound connections have been terminated. It is also recommended that cron entries, systemd units, and shell startup files be reviewed for unauthorized changes.  Updated applications, plugins, and server components, as well as unused services and unnecessary administrative paths or file upload paths, should be restricted. Furthermore, organizations should limit outbound connections to destinations necessary for normal operations and monitor any unexpected communications that may occur from web server processes.  The configuration of temporary and memory-backed directories should be modified so that they cannot be executed, thereby reducing the opportunity for attackers to launch hidden payloads. Moreover, Microsoft advised prioritizing Linux kernel security updates, focusing primarily on the CVE-2026-43284, as well as monitoring suspicious web application processes.  A compromised Linux server cannot be considered secure unless the GSocket client, persistence mechanisms, and all remaining outbound communication are addressed as part of incident response. According to its research, removing the entry point is only one component of incident response. As the GSocket client is increasingly abused, organizations face difficulties identifying legitimate tools repurposed for malicious purposes.  Linux environments must be secured against internet-facing applications, monitored outbound network traffic, and audited for persistence mechanisms in order to detect hidden access and be protected from long-term compromises.

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server…

Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface.

Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.

Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.

Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.

At a Glance Malware Family cwpdoor backdoor (trojanized cwpsrv 64-bit Linux ELF binary for versions 1.15.10 and 1.24.0) Threat Actor Unattributed (found alongside the Ebury SSH backdoor in one Brazilian incident; connection unconfirmed) Target / Victims Linux servers running Control Web Panel (1 confirmed victim upload in Brazil; 342,591 exposed CWP instances tracked globally) Delivery Vector

Attackers abuse the open-source GSocket tool to keep access to Linux servers even after the flaw is patched. What to check on one machine and how to respond.

A sophisticated attempt to introduce malicious code into a widely used software component has exposed significant weaknesses in the way businesses depend on externally developed technology, raising concerns about the security of software supply chains and the systems organisations rely upon for everyday operations.The incident involved XZ Utils, an open-source data compression utility incorporated into numerous Linux operating systems. Although largely invisible to ordinary users, the software f

CWPdoor is a stealthy Linux backdoor embedded in a popular server panel, evading detection and exposing over 340,000 public instances to risk.

Microsoft has warned that attackers are using a free remote access tool called GSocket to stay inside Linux servers even after the original security hole is fixed. Many admins treat a patch as the end of an incident, but this activity shows that patching alone may leave the attacker’s access untouched. GSocket is an open source tool built for remote administration. Attackers have turned it into a quiet backdoor because it hides its traffic inside a shared public relay network. Other researchers have also seen AI-generated scripts spreading GSocket in recent Linux intrusions, which shows how widely the tool is being reused. Researchers from Microsoft identified the activity through Microsoft Defender for Endpoint data and described it in a new report published on November 11, 2026. The report was written by Yash Gund, Sumith Maniath, and the wider Microsoft Security Research team. Microsoft noted that several unrelated threat actors have adopted the same tool, and that detections grew by 356.2% between March and August 2026, though the rise was uneven from month to month. Microsoft Warns Hackers Are Using GSocket Backdoors The attacks start with a flaw in an internet-facing web application. Once attackers can run commands through the web server, they use curl to download a script and run it with bash. The script checks the host, picks a GSocket client that matches the system type, and saves it in a writable or memory-backed folder such as /dev/shm. That access normally lasts only until the bug is fixed or the service restarts, so attackers add a second way in. GSocket solves this problem for them. Both the infected server and the attacker connect outward to the Global Socket Relay Network, which pairs the two sessions over an encrypted channel. After code execution on an internet-facing application (Source – Microsoft) The server needs no open port or public IP address, and inbound firewall rules never see the traffic. Because the tool runs on its own, separate from the hacked application, patching the original bug does not remove it. Connections are matched using a shared secret rather than an IP address or domain. The install script creates a random secret, and the attacker can read it from the console, from a temporary file, or through Telegram, Discord, or a webhook. With that secret, the attacker can return at any time from any compatible GSocket client. Blocking an IP address or domain is therefore unlikely to cut off access, because there is no attacker-owned server to block. The attackers also work to avoid being noticed. Microsoft saw them rename the process to look like a kernel thread, keep persistence through cron jobs, systemd services, shell profiles, and watchdogs, and delete the staging files afterward. Some used the same trick seen in fileless PHP web shells on Linux : hiding in places that look normal during a quick check. Who Is Being Hit and How to Respond Web applications and hosting systems made up 87.1% of the incidents Microsoft could attribute. PHP applications and cPanel hosting accounted for 63.9% of those, and Apache for 24.3%. Education and research organizations were the largest share of affected groups at 30.7%, followed by technology and telecommunications at 22.9%. Microsoft says this likely reflects exposure rather than deliberate targeting, since universities often run large web estates outside central IT that are hard to track and patch. Attack chain (Source – Microsoft) Admins who have followed recent cPanel vulnerabilities exposing hosting servers will recognize this kind of environment. In a few cases, the attackers also tried to gain root access by exploiting CVE-2026-43284, a Linux kernel bug known as Dirty Frag. Our earlier coverage of the Dirty Frag Linux kernel flaw explains why kernel patching matters on internet-facing servers. Microsoft’s main advice is to fix the host as well as the bug. Admins should remove the GSocket client, its persistence entries, and any staged files, then confirm that outbound connections to the relay have stopped. Other steps include setting deny-by-default egress rules, mounting temporary and memory-backed folders as non-executable, and reviewing cron entries, systemd units, and shell startup files. Microsoft also recommends running Defender for Endpoint on Linux with real-time protection turned on. Indicators of compromise (IoCs):- Indicator Type Description gsocket[.]io Domain Script and installer retrieval cdn[.]gsocket[.]io Domain Client binary distribution gsgg[.]b-cdn[.]net Domain Client binary distribution hxxps://gsocket[.]io/y URL Script retrieval in download-and-execute commands hxxps://gsocket[.]io/install.sh URL Installer retrieval target; successful retrieval not established hxxps://gsgg[.]b-cdn[.]net/bin/gs-netcat_mini-linux-x86_64 URL Download source for the x86-64 file hxxps://cdn[.]gsocket[.]io/bin/gs-netcat_mini-linux-aarch64 URL Download source for the AArch64 file /dev/shm/.gs-0/gs-netcat_mini-linux-x86_64 Filepath HackTool:Linux/GsNetcat.A!MTB; hidden staging directory d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa SHA256 Hash for the x86-64 file in /dev/shm/.gs-0 /dev/shm/.gs-0/gs-netcat_mini-linux-aarch64 Filepath HackTool:Linux/GsNetcat.A!MTB; AArch64 payload f95c4d029e6784e3849b4d1e2e2ae1a661187236ef7c5d487c71158a290a03b5 SHA256 Hash for the AArch64 file in /dev/shm/.gs-0 /tmp/systemd-remount-d Filepath HackTool:Linux/GsNetcat!rfn; service-like filename /usr/bin/systemd-remount-d Filepath HackTool:Linux/GsNetcat!rfn; service-like filename 55d141bb2f62c527c3fea3413b8429fed7d52633d0b123b5e611bfa42165229f SHA256 Hash for both systemd-remount-d paths /tmp/.gsn_ora Filepath Hidden file; HackTool:Linux/GsNetcat.A!MTB 12450bafc7a4398040e1ad3a16dbf4dbc79b6a8f83ef306c4f0f73f59886f06c SHA256 Hash for /tmp/.gsn_ora Note:   IP addresses and domains are intentionally Qdefanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs The post Microsoft Warns Hackers Are Using GSocket Backdoors to Keep Linux Servers Compromised After Patching appeared first on Cyber Security News .

CWPdoor replaces Control Web Panel's web server after root access, enabling command execution through requests hidden from access logs.

A new Linux malware called CWPdoor is being distributed through a trojanized version of cwpsrv, the web server behind the Control Web Panel (CWP) management interface. [...]

CWPdoor replaces Control Web Panel's web server after root access, enabling command execution through requests hidden from access logs.