Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Pages: [1]
1
CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.
« on: June 18, 2026, 04:36:58 PM »
My server was recently compromised, and many websites hosted on it had their index.php files injected with malicious code similar to:
eval(base64_decode("aW5pX3NldCgiZGlzcGxheV9lcnJv..."));
I also found unauthorized SSH keys added to authorized_keys files and several suspicious files such as defauit.php across different accounts.
I have cleaned the infections multiple times, removed the malicious files, changed passwords, and scanned the server, but the infection keeps returning approximately every 30 minutes.
What I've observed is that the reinfection process appears to run for about 2-3 minutes. During that time, if I clean the infected files, they are immediately reinfected. Outside of that window, there is usually a delay of around 30 minutes before the files are modified again.
So far, I have been unable to identify the root cause or the process responsible for the reinfection. There are no obvious cron jobs, and the malware continues to reappear after cleanup.
Has anyone dealt with a similar compromise or persistent reinfection on a CWP/CentOS server? Any advice on how to trace the source of the reinfection, identify the responsible process, or locate hidden backdoors would be greatly appreciated.
eval(base64_decode("aW5pX3NldCgiZGlzcGxheV9lcnJv..."));
I also found unauthorized SSH keys added to authorized_keys files and several suspicious files such as defauit.php across different accounts.
I have cleaned the infections multiple times, removed the malicious files, changed passwords, and scanned the server, but the infection keeps returning approximately every 30 minutes.
What I've observed is that the reinfection process appears to run for about 2-3 minutes. During that time, if I clean the infected files, they are immediately reinfected. Outside of that window, there is usually a delay of around 30 minutes before the files are modified again.
So far, I have been unable to identify the root cause or the process responsible for the reinfection. There are no obvious cron jobs, and the malware continues to reappear after cleanup.
Has anyone dealt with a similar compromise or persistent reinfection on a CWP/CentOS server? Any advice on how to trace the source of the reinfection, identify the responsible process, or locate hidden backdoors would be greatly appreciated.
2
CentOS 7 Problems / Re: ReferenceError: $ is not defined
« on: January 17, 2020, 08:16:54 PM »
it seems like js.php is not loading on the admin theme. its giving 500 error. because of which many actions not working on admin panel. i am using CWP7 bytheway.
3
CentOS 7 Problems / ReferenceError: $ is not defined
« on: January 17, 2020, 05:16:45 PM »
Hi,
Recently shifted to centos panel from cpanel, IT was fine couple of days ago but today i see an error on centos panel admin account (whm) there is some consol error :
ReferenceError: $ is not defined
several times. I guess jquery is not loaded getting loaded on page for some reason.
Could some one help about the issue.
Regards,
Muhammad.
Recently shifted to centos panel from cpanel, IT was fine couple of days ago but today i see an error on centos panel admin account (whm) there is some consol error :
ReferenceError: $ is not defined
several times. I guess jquery is not loaded getting loaded on page for some reason.
Could some one help about the issue.
Regards,
Muhammad.
Pages: [1]
