Messages

1

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 18, 2026, 07:50:38 PM »

@ideal:

Code: [Select]


systemctl list-unit-files --type=service --state=enabled

İf you see "defunct.service" in list:
systemctl stop defunct.service
systemctl disable defunct.service
cat /usr/lib/systemd/system/defunct.service (You can see: '/usr/bin/defunct'")
rm -f /usr/lib/systemd/system/defunct.service
systemctl daemon-reload
rm -f /usr/bin/defunct

Yo can kill it :)

After:
search .ssh dirs
delete all .ssh dirs

example for root/.ssh:
sudo chattr -R -i /root/.ssh

check /home dir if this dirs exists: (login chromeuser) delete:
sudo chattr -R -i /home/login
sudo chattr -R -i /home/chromeuser
rm -rf /home/login
rm -rf /home/chromeuser

Search files for infaction codes and clear all

I think this security issue cause of Roundcube version: 1.4.14



2

CentOS-WebPanel Bugs / CWP's problems that need to be fixed urgently

« on: June 17, 2026, 10:03:26 AM »

CWP's problems that need to be fixed urgently

1) CWP still uses 7.1 as internal PHP version. That's why roundcube etc. Versions of .com with serious security vulnerabilities are installed (In this way, full access to more servers is gained and hacked every day.) roundcube etc. The current versions of many additional software used in CWP are PHP 7.1. It doesn't work with .
2) The installation package cannot detect/make the right decision about the operating system on which it is installed: When you install CWP on AlmaLinux 9, CWP still uses the service command when starting/stop/resetting PHP FPMs and querying their status as if it were in CENTOS 7 (This causes the command not to work in AlmaLinux 9 and PFP FPM to not work).
3) The backup issue is still very problematic and confusing. Backups taken from the customer panel do not consist of a single file. Also, CWP->CWP migration is very problematic. There is still no simple way to start a backup for a single account via SSH and import this backup to another CWP. (There is no solution like cPnanel's packageacct)

There are many other deficiencies and errors, but even the most critical errors have not been corrected for a long time. If the developers are no longer going to continue developing CWP, they should announce it because it will take a long time for us to take action and move on to other panels.

3

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 15, 2026, 08:06:32 PM »

ghoste - I agree with what you say

4

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 15, 2026, 05:55:52 PM »

Another server with CWP version 0.9.8.1231 was just hacked using the same method. Reportedly, this vulnerability has been closed in this version.

However, the security breach still continues!!!!. I don't think the security vulnerability was closed properly, it still persists...

5

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 14, 2026, 04:06:33 PM »

As far as I can see, if you install clean AlmaLinux 9 and then install CWP, the CWP installation package still installs the 1.14.X vulnerable version of roundcube.

So even if everything is up to date, you all have the same vulnerability.

6

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 14, 2026, 01:45:09 PM »

Even this forum is problematic from top to bottom and we try for hours to even write an answer with BUGs, sometimes we succeed, sometimes we don't (Especially when we want to answer with quotes)

7

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 14, 2026, 01:44:07 PM »

Simple solution, keep your servers updated.
And IF you are still running CentOS 7, you can expect to be hacked, running an EOL OS that is public facing.

There was a major Kernel Auth vulnerability that's has been activity exploited.
AlmaLinux released fixed Kernels on 2026-06-08 for AL8 and AL9.

Someone mentioned an old CVE for Roundcube, that only affected Roundcube Webmail versions prior to 1.5.10.
The current version is 1.5.15

Servers using Apache also had a problem, that the update to 2.4.68 fixed

Unfortunately, we cannot do this at this stage because CWP is really terrible and most critical parts constantly have BUGs and do not work properly.

8

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 14, 2026, 01:37:33 PM »

You are doing a clean installation on almalinux9. CWP is still trying to use the service command in the background. Friends, don't these developers know that the service command does not work in Almalinux 9?

9

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 14, 2026, 01:35:13 PM »

I prepared a new server and installed almalinux9. I want to move the sites on the old server to the new server, but CWP->CWP migration does not work.

I take a manual backup from the old server and move it to the new server without any problems, but when importing it on the new server, it cannot open the compressed file and gives an error.

CWP is really starting to cost our days and our health.

Tickets that are not answered for days, security vulnerabilities that are not completely closed, functions that never work properly, etc.

10

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 13, 2026, 07:47:30 PM »

I also noticed two days ago that the entry point is webftp_simple, I just didn't want to mention it here.

11

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 13, 2026, 04:18:43 PM »

We saw similar behavior on AlmaLinux 9.8 / CWP.

Observed IOCs:
- external IP: 89.248.172.183
- webshell path: /temp/.x.php
- CWP service-path shell: /usr/local/cwpsrv/var/services/oauth/v1.0a/server/www/.r.php
- downloaded payload source: mars.imasync.com
- repeated unauthorized SSH key fingerprint: SHA256:w79EbEKrlqugvMc8n/i9dQ5QuvhFBdJZDA/UKdSek2o
- mass unauthorized authorized_keys files across service/user accounts
- sudoers NOPASSWD backdoors for service/system accounts
- service/system account password hashes were set

Same problem. CWP urgently needs to do something about this issue. The situation exists even on the latest OS.

It is only a matter of time before our servers are encrypted. If it is encrypted, everything will be gone.

12

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 13, 2026, 03:51:38 PM »

I can't paste my log here forum not accept

13

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 13, 2026, 03:50:19 PM »

@iswap not succsess

14

CentOS-WebPanel Bugs / Re: I think there is a very serious security vulnerability in CWP right now.

« on: June 13, 2026, 03:18:20 PM »

We are probably talking about the same problem.

but the problem exists on a server with almalinux8 and up to date

15

CentOS-WebPanel Bugs / I think there is a very serious security vulnerability in CWP right now.

« on: June 13, 2026, 09:34:32 AM »

I think there is a very serious security vulnerability in CWP right now. My and my friends' 10's of servers were hacked with this vulnerability. I've been trying to identify the source for days.

Now I think I may have found the source of the problem. If this vulnerability is as I guess, it is a very serious security vulnerability. They can easily gain root access to the server.

I have been trying to explain this to CWP staff through the ticket system for days, but freelancers are handling the tickets. I mention that there may be a serious security vulnerability in the CWP panel right now, and they say pay me to look at your ticket.