[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

operational guidance (QiAnXin XLab, Nov 5)

Tip: on any Control Web Panel server, run the three cwpdoor checks today, and if one hits, treat the box as rooted

  • ss -axp | grep integrity should return nothing; strings /usr/local/cwpsrv/bin/cwpsrv | grep -c X-Ngx-Integrity should be 0.
  • Hit: restore from /usr/local/cwpsrv/bin/cwpsrv.prev-* if present (the installer may delete it), upgrade CWP, re-check, change every panel and root credential, and look for Ebury and other persistence. Rebuilding is safer.
  • Block 136.0.141[.]71 and keep the CWP panel ports off the internet (VPN or IP allowlist).

Sources: QiAnXin XLab: CWPdoor (Nov 5)