Possible CWP Security Issue – Malicious JavaScript Injection

I have the files.

Do you need them?

Im tired of cleaning server. Im stop using CWP for a while.

Don't use a server using MariaDB, ImageMagick, OpenSSH, aaPanel, OpenDMARC, OpenPanel, cPanel, +more...

They are just some of the latest CVE's in the past 30 days that could allow remote code execution if you don't keep them up2date.

All EOL OS'es that have no security updates are a hacker's paradise right now also, e.g. CentOS 7.

Any step by step guide to check the infection and clean? Looks like atleast 1 of my installation is infected

Hi all.

GSocket come back in one of my servers.
I found this file in /usr/local/cwpsrv/var/services/api/v1

-rw-r--r--  1 root   root   16458015 Oct  5 08:09 deploy-all.sh

[root@srv04 v1]# stat deploy-all.sh
  File: deploy-all.sh
  Size: 16458015        Blocks: 32152      IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 409139      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2026-10-14 21:36:51.313172533 -0300
Modify: 2026-10-05 08:09:09.314262697 -0300
Change: 2026-10-05 08:09:09.314262697 -0300
 Birth: 2026-10-05 08:09:09.284261891 -0300


Check yours!

Take a look to all your tmp directories too under each user folder, like: /home/<username>/tmp

I found a lot of php files hidden like session files.

I made this little but easy bash script to delete all the files inside tmp user directories.

Code: [Select]

for user in $(ls /home); do
    HOMEDIR="/home/$user"
    if [ -d "$HOMEDIR/tmp" ]; then
        rm -rf "$HOMEDIR/tmp"/*
        echo "Emptied tmp for: $user"
    fi
done


Thanks for sharing this finding. Checking the temporary directories of individual hosting accounts is definitely worthwhile during a compromise investigation.

However, I would be careful with the cleanup script. Deleting everything under /home/*/tmp can remove legitimate PHP sessions, application-generated files and potentially valuable forensic evidence.

Before deleting anything, I would first inventory the PHP files:
find /home -type f -path '*/tmp/*.php' \
  -printf '%TY-%Tm-%Td %TH:%TM %u %p\n'

Then examine suspicious files individually without executing them:
stat /path/to/suspicious.php
sha256sum /path/to/suspicious.php
file /path/to/suspicious.php

I would also check whether these files contain suspicious encoded payloads, unexpected command-execution functions or references to unfamiliar external servers.

Most importantly, correlate their creation times with website access logs. If the same suspicious PHP payload appears under multiple hosting accounts, investigate whether a shared vulnerability or server-level persistence mechanism is responsible.

Preserve suspicious samples before removing them. If root compromise is suspected, consider isolating the server and recovering from a trusted installation.

Full disclosure: I'm the developer of the CWP7 Security Audit Module. I developed it to help CWP administrators investigate suspicious files and persistence indicators. It may help with a broader server-wide investigation, although its coverage of these particular temporary directories should be verified.

Have you checked whether the suspicious files share identical hashes or reappear after deletion? That could help determine whether you're dealing with repeated application infections or an active persistence mechanism.