New security issue? 09.09.2026

hello

Today, I noticed a file named "test123zz" in the `public_html` directories of user accounts across many of my CWP servers; the owner of these files appears to be root.

I also observe that malicious files named "aby.php" and "vio.php" (And many .html files) were uploaded to the `public_html` directories at the same time as this file.

Seeing this same situation across multiple servers running the CWP panel led me to suspect that the issue might be related to CWP itself. However, if I open a support ticket, CWP asks for payment upfront.

Could you please check the `public_html` directories of the user accounts on your servers and confirm whether these files have been injected into your systems as well?

Yes, I've been battling this one for a few days now and looking for their way in.
It appears the test one is an initial probe and then the aby.php appears.  That appears to be a shell of sorts.

It then goes about infecting the site with casino redirects - thai or indonesian thing.

And here's a new one:  look for google domain verification HTMLs of the same date.  They are taking over domains into their own search console accounts.  Try finding somewhere/someone at Google to report this .. I haven't got very far in that endeavour!

I did note that a lot of the files were attributed to root.  In your /home directory run:  find . -user root |grep public
If you want a date as well:  find . -user root -printf "%-25p %t\n" |grep public

For the google verification files, run:  find . -name google*.html -printf "%-25p %t\n" |grep public
and check for recent dates.

I also noted files inserted into the wp-content/languages directory.

Will report back if I find anything more!

Currently, many of my servers running AlmaLinux 9 and the latest version of CWP have been hacked using this method.

The attackers are gaining full root access; they are redirecting sites on the server to gambling sites, performing their own Google account verifications, and installing and running crypto-mining services in the background.

I hope CWP is aware of this issue; servers with up-to-date operating systems and the latest CWP panels are being compromised again.

We had previously reformatted and reinstalled the servers I am referring to because they had been hacked due to earlier CWP vulnerabilities, yet serious security flaws persist even in the latest version.

NOTE: This vulnerability is not the same one from previous months. It is a vulnerability discovered this month, as the operating systems and CWP versions on the servers are up to date; furthermore, the servers in question were reformatted and reinstalled approximately one week ago.

this might help https://github.com/sminozzi/casino-seo-poisoning-guide

hacker probably still has an access to server through infected/fake process and/or cronjobs, Ive used gemini to solve this problem

you can start with checking who is connected to your server right now with following command:

Code: [Select]

netstat -antp | grep -E "ESTABLISHED|LISTEN"
you will see something like this:
tcp        0      0 *IP*:*PORT*     *IP*:*PORT* ESTABLISHED 2927707/nginx: work
tcp        0      0 *IP*:*PORT*     *IP*:*PORT*     ESTABLISHED 2975254/dovecot/ima
tcp        0      0 *IP*:*PORT*    *IP*:*PORT*   ESTABLISHED 2212967/dovecot/ima
tcp        0      0 *IP*:*PORT*      *IP*:*PORT*    ESTABLISHED 2945502/sshd: root 
tcp        0      0 *IP*:*PORT*       *IP*:*PORT*   ESTABLISHED 2928151/cwpsrv: wor
look for "cwpserv" and "sshd". other ones like dovecot, nginx etc are usually fine, if *IP* is unknown to you then I suggest you to kill the connection and ban the IP

then you can check for deleted processes:

Code: [Select]

ls -al /proc/*/exe 2> /dev/null | grep 'deleted'if have any output then its probably is infected process which was used by hacker to get access, use gemini or w/e AI for further steps, you need to find where this process came from and delete files