Control Web Panel

WebPanel => CentOS-WebPanel GUI => Topic started by: anandmys on October 26, 2026, 12:37:43 PM

Title: CWP Security Audit - Unknown file
Post by: anandmys on October 26, 2026, 12:37:43 PM

Getting this alert

Code: [Select]

CWP Security Audit - Unknown file

Unknown file: /opt/php-build-deps/lib64/libzip.so.5.5
Should I be concerned?

Also getting

Code: [Select]

CWP Security Audit - Ghost files

Ghost files found for apache

Title: Re: CWP Security Audit - Unknown file
Post by: overseer on October 26, 2026, 02:34:15 PM

No concern on the first, a false positive. Does it show any additional information on the "ghost files"? Did you get your casino SEO problem taken care of? Did you find that malicious Apache module that was producing the output for the bots?

Title: Re: CWP Security Audit - Unknown file
Post by: jeffshead on October 26, 2026, 07:18:29 PM

I was watching this vid (https://www.youtube.com/watch?v=ksmWCWw5Vd4), logged into CWP admin and have the same two errors and others.

(https://i.postimg.cc/D0YKhBPz/errors.jpg)

Title: Re: CWP Security Audit - Unknown file
Post by: overseer on October 26, 2026, 10:14:02 PM

I would double check to make sure you don't have any fake kernel threads running or deleted processes running out of memory. tuned is legitimate, as long as it's not another process trying to disguise itself as tuned.

Title: Re: CWP Security Audit - Unknown file
Post by: Starburst on October 26, 2026, 11:25:47 PM

I asked Sandeep about:

(https://i.postimg.cc/dtbgqNkB/CWP-Security-Audit-2026-10-22.png)

He said that error was a false positive from php-manager.

--

The rest looks like you have another or several other problems with the server, and some things that aren't configured correctly.

Title: Re: CWP Security Audit - Unknown file
Post by: jeffshead on October 27, 2026, 02:48:36 AM

Thanks for the responses!

Currently 229 processes running. How do you know if any/which ones are illegitimate?

Since recent server updates were installed, the Server health and performance counters no longer auto-refresh, either.

I also noticed that I now get a 403 when accessing any info.php, for any user. If I exclude INFO_MODULES, the other php data displays.