I believe I got hit by the PHP2SHELL vulnerability. I experienced several issues. I ended up restoring a 5 day old backup of the entire server VM. That worked and so far, I haven't encountered the previous errors.

However, I suffered from the same issue (after updates were applied) of not being able to access the admin and getting the 500 error. I ran the QuickFix posted Administrator and can once again access the admin but I still get the following errors and the counters on the dashboard do not auto-update every 5 seconds like they're supposed to:
2026/10/27 19:08:05 [crit] 547931#0: *1 connect() to unix:/usr/local/cwp/php71/var/sockets/cwpsrv.sock failed (2: No such file or directory) while connecting to upstream, client: 10.10.10.10, server: localhost, request: "GET /cwp_teffb8f756156acde5d815e1b9730053/admin/loader_ajax.php?ajax=dashboard&updateCWP=yes HTTP/1.1", upstream: "fastcgi://unix:/usr/local/cwp/php71/var/sockets/cwpsrv.sock:", host: "server.example.com:2031", referrer: "https://server.example.com:2031/cwp_teffb8f756156acde5d815e1b9730053/admin/index.php?"
2026/10/27 19:08:05 [crit] 547931#0: *1 connect() to unix:/usr/local/cwp/php71/var/sockets/cwpsrv.sock failed (2: No such file or directory) while connecting to upstream, client: 10.10.10.10, server: localhost, request: "GET /cwp_teffb8f756156acde5d815e1b9730053/admin/loader.php?func=get_load&_=1793142453397 HTTP/1.1", upstream: "fastcgi://unix:/usr/local/cwp/php71/var/sockets/cwpsrv.sock:", host: "server.example.com:2031", referrer: "https://server.example.com:2031/cwp_teffb8f756156acde5d815e1b9730053/admin/index.php?"
2026/10/27 19:08:06 [crit] 547932#0: *4 connect() to unix:/usr/local/cwp/php71/var/sockets/cwpsrv.sock failed (2: No such file or directory) while connecting to upstream, client: 10.10.10.10, server: localhost, request: "GET /cwp_teffb8f756156acde5d815e1b9730053/admin/loader.php?func=get_top_short&_=1793142453398 HTTP/1.1", upstream: "fastcgi://unix:/usr/local/cwp/php71/var/sockets/cwpsrv.sock:", host: "server.example.com:2031", referrer: "https://server.example.com:2031/cwp_teffb8f756156acde5d815e1b9730053/admin/index.php?"
How do you fix this?