Possible CWP Security Issue – Malicious JavaScript Injection

I have the files.

Do you need them?

Im tired of cleaning server. Im stop using CWP for a while.

Don't use a server using MariaDB, ImageMagick, OpenSSH, aaPanel, OpenDMARC, OpenPanel, cPanel, +more...

They are just some of the latest CVE's in the past 30 days that could allow remote code execution if you don't keep them up2date.

All EOL OS'es that have no security updates are a hacker's paradise right now also, e.g. CentOS 7.

Any step by step guide to check the infection and clean? Looks like atleast 1 of my installation is infected

Hi all.

GSocket come back in one of my servers.
I found this file in /usr/local/cwpsrv/var/services/api/v1

-rw-r--r--  1 root   root   16458015 Oct  5 08:09 deploy-all.sh

[root@srv04 v1]# stat deploy-all.sh
  File: deploy-all.sh
  Size: 16458015        Blocks: 32152      IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 409139      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-10-14 21:36:51.313172533 -0300
Modify: 2026-10-05 08:09:09.314262697 -0300
Change: 2026-10-05 08:09:09.314262697 -0300
 Birth: 2026-10-05 08:09:09.284261891 -0300


Check yours!