Author Topic: CWP Security Audit - Unknown file  (Read 196 times)

0 Members and 2 Guests are viewing this topic.

Offline
***
CWP Security Audit - Unknown file
« on: October 26, 2026, 12:37:43 PM »
Getting this alert

Code: [Select]
CWP Security Audit - Unknown file

Unknown file: /opt/php-build-deps/lib64/libzip.so.5.5

Should I be concerned?

Also getting

Code: [Select]
CWP Security Audit - Ghost files

Ghost files found for apache


Offline
*****
Re: CWP Security Audit - Unknown file
« Reply #1 on: October 26, 2026, 02:34:15 PM »
No concern on the first, a false positive. Does it show any additional information on the "ghost files"? Did you get your casino SEO problem taken care of? Did you find that malicious Apache module that was producing the output for the bots?

Offline
*
Re: CWP Security Audit - Unknown file
« Reply #2 on: October 26, 2026, 07:18:29 PM »
I was watching this vid (https://www.youtube.com/watch?v=ksmWCWw5Vd4), logged into CWP admin and have the same two errors and others.




Offline
*****
Re: CWP Security Audit - Unknown file
« Reply #3 on: October 26, 2026, 10:14:02 PM »
I would double check to make sure you don't have any fake kernel threads running or deleted processes running out of memory. tuned is legitimate, as long as it's not another process trying to disguise itself as tuned.

Offline
*****
Re: CWP Security Audit - Unknown file
« Reply #4 on: October 26, 2026, 11:25:47 PM »
I asked Sandeep about:



He said that error was a false positive from php-manager.

--

The rest looks like you have another or several other problems with the server, and some things that aren't configured correctly.
« Last Edit: October 26, 2026, 11:29:07 PM by Starburst »

Offline
*
Re: CWP Security Audit - Unknown file
« Reply #5 on: Today at 02:48:36 AM »
Thanks for the responses!

Currently 229 processes running. How do you know if any/which ones are illegitimate?

Since recent server updates were installed, the Server health and performance counters no longer auto-refresh, either.

I also noticed that I now get a 403 when accessing any info.php, for any user. If I exclude INFO_MODULES, the other php data displays.
« Last Edit: Today at 02:52:19 AM by jeffshead »