Recent Posts
91
CentOS-WebPanel Bugs / Re: [CRITICAL] Multiple CWP Servers Infected – Arbitrary PHP Code Execution via Publ
« Last post by pedromidiasf on July 05, 2026, 09:36:56 PM »Just read that eval cant actually be blocked? I have added assert. I cant see any issues website wise yet.if you have websites that need that command it will be a problem. But if you don't need it, that's fine
92
Updates / Re: update 0.9.8.1239 remove all users database + postfix acc
« Last post by Reikor on July 05, 2026, 09:11:42 PM »This is all hapening because someone from Dev Team went rogue.
check new posts.
check new posts.
93
Updates / Dev Team went rogue ?
« Last post by Reikor on July 05, 2026, 09:10:52 PM »Ok, after analizing the temp_hacker_check we discover this script is trying to prevent SOMEONE to get into the servers using cwpro.
It seems a Dev Team person went Rogue and this script is preventing and erasing posible ssh keys, db access and all that kind of stuff that a hacker will use to get into the servers using this soft.
So there is a person hacking all the CWPRO servers using a Gsocket Backdoor and the hacker key begins with IPCsi58x.... and using mysql users also, there is a bug operator=/root erasing all keys.
This is hapenning in ALL the servers using this panel. and you can see if you look closely there is in your hosts a 127.0.0.1 gsocket.io and cloudsyndication.org. Blocks by this scripts to keep hackers outside.
So i will love and explanation from someone from cwpro, to come clean about this... We love this panel and we dont gonna change, but we can help you.
It seems a Dev Team person went Rogue and this script is preventing and erasing posible ssh keys, db access and all that kind of stuff that a hacker will use to get into the servers using this soft.
So there is a person hacking all the CWPRO servers using a Gsocket Backdoor and the hacker key begins with IPCsi58x.... and using mysql users also, there is a bug operator=/root erasing all keys.
This is hapenning in ALL the servers using this panel. and you can see if you look closely there is in your hosts a 127.0.0.1 gsocket.io and cloudsyndication.org. Blocks by this scripts to keep hackers outside.
So i will love and explanation from someone from cwpro, to come clean about this... We love this panel and we dont gonna change, but we can help you.
94
Other / Re: The CWPpro version 0.9.8.1239 update destroyed sshd and .ssh.
« Last post by Longhorn on July 05, 2026, 08:48:02 PM »Does anyone knows about how to fix the script "fix_cwpsrv_logs" that is damaged? The new update released today doesn't fix it.
95
Backup / Rocky Linux 9 (9.8) not backuping GRANTs (mariadb)
« Last post by julianmaria on July 05, 2026, 08:24:21 PM »I have multiple servers running CWP
Centos 7.9 (old ones) / Alma -8,9- / Rocky 9
I detected that the Server running Rocky Linux release 9.8 (Blue Onyx) never backuped GRANTS in /backup/mysql/daily weekly/monthy
All the other dbs including CWP ones are ok there (mysql/root_cwp/roundcube/other dbs)
Should i modify privileges to cwproot ?
Thank!
Centos 7.9 (old ones) / Alma -8,9- / Rocky 9
I detected that the Server running Rocky Linux release 9.8 (Blue Onyx) never backuped GRANTS in /backup/mysql/daily weekly/monthy
All the other dbs including CWP ones are ok there (mysql/root_cwp/roundcube/other dbs)
Should i modify privileges to cwproot ?
Thank!
96
Updates / Re: update 0.9.8.1239 remove all users database + postfix acc
« Last post by overseer on July 05, 2026, 05:25:45 PM »Now 0.9.8.1243 on the fast track (not Stable/2 weeks tested).
97
Other / Re: The CWPpro version 0.9.8.1239 update destroyed sshd and .ssh.
« Last post by André Bastos on July 05, 2026, 05:00:50 PM »To prevent access loss in our case, the solution was to create a service that checks the MD5 hash of the SSH keys; if it detects a discrepancy, it copies the keys from a backup stored on the server itself.
Fortunately, we own our servers and run them on Proxmox. Manually recovering and restoring access to over 100 servers—one by one via CWP—would be a nightmare.
There is also an issue with database users granted wildcard (`%`) access; they get removed during every CWP update.
To resolve this, we keep a local backup of the MySQL table; whenever the script—which runs periodically to fix this—detects a discrepancy, it restores the user and their permissions.
This was a major failure that directly impacts customers. I hope they resolve this as quickly as possible, treating it as a top priority.
Fortunately, we own our servers and run them on Proxmox. Manually recovering and restoring access to over 100 servers—one by one via CWP—would be a nightmare.
There is also an issue with database users granted wildcard (`%`) access; they get removed during every CWP update.
To resolve this, we keep a local backup of the MySQL table; whenever the script—which runs periodically to fix this—detects a discrepancy, it restores the user and their permissions.
This was a major failure that directly impacts customers. I hope they resolve this as quickly as possible, treating it as a top priority.
98
Updates / fix_cwpsrv_logs broken and prevent cpwsrv to restart
« Last post by juanyves on July 05, 2026, 02:35:02 PM »Seems that in the new fix_cwpsrv_logs file there are some errors:
line 14 is not completed (I suppose lack of ";" at the end)
NEW_BLOCK=" map \$http_x_real_ip \$stvarni_user_ip {\n \"\" \$remote_addr;\n default \$http_x_real_ip;\n }\n\n log_format main '\$stvarni_user_ip - \$remote_user [\$time_local] \"\$request\" \$status \$body_byte$
But then no way to restart cwpsrv.service
- "$" at the end of the line 14 seems wrong
- system says : cwpsrv: [emerg] nknown "body_byte" variable (I suppose unknown)
- system says : cwpsrv: [warn] he "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /usr/local/cwpsrv/conf.d/api.conf:8 (Just warning, I suppose it should be "listen localhost ssl;")
I rewrite line 11 in cwpsrv.conf as "log_format main '$stvarni_user_ip - $remote_user [$time_local] $request $status';" so I could have cwpsrv.service restarted and have everything working.
line 14 is not completed (I suppose lack of ";" at the end)
NEW_BLOCK=" map \$http_x_real_ip \$stvarni_user_ip {\n \"\" \$remote_addr;\n default \$http_x_real_ip;\n }\n\n log_format main '\$stvarni_user_ip - \$remote_user [\$time_local] \"\$request\" \$status \$body_byte$
But then no way to restart cwpsrv.service
- "$" at the end of the line 14 seems wrong
- system says : cwpsrv: [emerg] nknown "body_byte" variable (I suppose unknown)
- system says : cwpsrv: [warn] he "ssl" directive is deprecated, use the "listen ... ssl" directive instead in /usr/local/cwpsrv/conf.d/api.conf:8 (Just warning, I suppose it should be "listen localhost ssl;")
I rewrite line 11 in cwpsrv.conf as "log_format main '$stvarni_user_ip - $remote_user [$time_local] $request $status';" so I could have cwpsrv.service restarted and have everything working.
99
Updates / CWP7: 0.9.8.1243
« Last post by cgauthey on July 05, 2026, 08:03:57 AM »CWP7: 0.9.8.1243
It appears that CWP has rolled out numerous updates—both minor and major—over the past few weeks, suggesting renewed interest in the control panel.
It appears that CWP has rolled out numerous updates—both minor and major—over the past few weeks, suggesting renewed interest in the control panel.
100
Updates / Re: update 0.9.8.1239 remove all users database + postfix acc
« Last post by HostingMalaya on July 05, 2026, 07:50:02 AM »I respond to the ticket
To what version ya ?
Just to make sure that its the correct version. is it newer than what updated 2 days ago ?
Then the respond,
Update CWP to latest stable version.
Regards,
Nitin P.
Thats all.
Currently I just disable the script for a while to avoid this issue. Until maybe other further notice or info.
To what version ya ?
Just to make sure that its the correct version. is it newer than what updated 2 days ago ?
Then the respond,
Update CWP to latest stable version.
Regards,
Nitin P.
Thats all.
Currently I just disable the script for a while to avoid this issue. Until maybe other further notice or info.
