Dev Team went rogue ?

Ok, after analizing the temp_hacker_check we discover this script is trying to prevent SOMEONE to get into the servers using cwpro.
It seems a Dev Team person went Rogue and this script is preventing and erasing posible ssh keys, db access and all that kind of stuff that a hacker will use to get into the servers using this soft.

So there is a person hacking all the CWPRO servers using a Gsocket Backdoor and the hacker key begins with IPCsi58x.... and using mysql users also, there is a bug operator=/root erasing all keys.

This is hapenning in ALL the servers using this panel. and you can see if you look closely there is in your hosts a 127.0.0.1 gsocket.io and cloudsyndication.org. Blocks by this scripts to keep hackers outside.

So i will love and explanation from someone from cwpro, to come clean about this... We love this panel and we dont gonna change, but we can help you.

That could be a possibility; just like you, i believe CWP is one the most complete panel  available, but all of these issues did not happen with cwp7 + centos7.

i know these are tough time for us, but i will keep using CWP for me is easy and very flexible

Quite the conspiracy theory... is there bona fide proof?
Juicy plot line -- I'm starting to hear a James Bond theme play... or maybe the Mission Impossible theme...

Quite the conspiracy theory... is there bona fide proof?
Juicy plot line -- I'm starting to hear a James Bond theme play... or maybe the Mission Impossible theme...

Dude, have you see whats inside the script?

Even it has a finger print of the attacker, they are blocking domains via hosts where the ex Dev Team member taht went rogue was using. And the cleanup of constantly deleting /root/.ssh is the only proof we need. Adev Team member went rogue.

I urgently passed the information on to José and shared this post with him; I think he will respond to this matter quickly—he has always stepped up, and he always will.

Does the rogue cwp team member drive an aston martin too ?