Control Web Panel
WebPanel => Updates => Topic started by: salescodedev on July 01, 2026, 02:42:43 PM
-
After this update, all my nodejs applications was down and i've some erros on my cwp
Warning: mysqli_connect(): (HY000/1045): Access denied for user 'postfix'@'localhost' (using password: YES) in /usr/local/cwpsrv/htdocs/resources/admin/include/functions.php on line 0 Warning: mysqli_connect(): (HY000/1045): Access denied for user 'postfix'@'localhost' (using password: YES) in /usr/local/cwpsrv/htdocs/admin/admin/index.php on line 0
when i check with ssh terminal on my mysql, the user postfix was removed.
after, i created and restart all services was fixed
But, i check my mysql manager, and see.... All users from my database are removed
I created all users and grant access, and all apps works
if you're having this problem, i can fix making this
-
All users (including postfix) are intact on my servers after the update.
Do you backup your MySQL (MariaDB) DB regularly?
-
Yes, i've dayli backups activated
I've two cwp servers, and have some problem in any
CWP A: postfix user removed + all database user removed (with same password) + all nodejs apps by node manager down
CWP B: all database user removed (with same password) + all nodejs apps by node manager down
-
Thanks for the minor heart attack when I saw these 2 threads today.
Checked all of our servers and all the users and system accounts are still there.
-
Of course I'm tracking the reports of an issue like this. All my servers are working fine, as is another one I am working on for someone else. All are running AlmaLinux 8 with no issues related to this to report.
-
Some of my clients having the same issue. The privilege users are gone and need to be readd.
-
After updating to **CWP 0.9.8.1239**, a new script was deployed at:
`/usr/local/cwpsrv/htdocs/resources/scripts/temp_hacker_check`
I believe this script is responsible for an issue that several users have reported.
The script automatically removes MySQL users based on rules that assume they are suspicious, for example:
* Users with `Host='%'` (remote access).
* Users with names such as `app`, `admin`, `sys`, `dbadmin`, etc.
While these checks may be useful on a server that has already been compromised, they are **not appropriate for many production environments**. It is very common for applications and hosting servers to legitimately use accounts like:
```sql
'app'@'%'
'api'@'%'
'admin'@'%'
```
The script executes `DROP USER` on these accounts, which breaks applications because the MySQL users are deleted.
This happened to me again today after the update. To verify my suspicion, I have **temporarily removed the `temp_hacker_check` script** from the server. I want to see if the issue stops occurring, but at this point I'm **99% confident that this script is the cause**, since its behavior matches exactly what I'm experiencing.
If anyone else is seeing MySQL users with `Host='%'` or users named `app`, `admin`, etc. disappearing after the update, please check whether this script is running on your server as well.
I think this script should either:
* avoid deleting legitimate MySQL users by default,
* use a whitelist,
* or make this behavior optional instead of automatically dropping database users.
-
This.. rerun daily.. omg why
-
Edit the /usr/local/cwpsrv/htdocs/resources/scripts/temp_hacker_check script like so:
#!/bin/bash
exit 0
...
-
i create support ticket, and someone replied just update to latest cwp.
Hello,
please try to update CWP to the latest version.
Regards,
Igor S.
-
So they released a new version and fixed this script? Has anyone tried updating?
-
I still show 0.9.8.1239 as the current version.
-
I respond to the ticket
To what version ya ?
Just to make sure that its the correct version. is it newer than what updated 2 days ago ?
Then the respond,
Update CWP to latest stable version.
Regards,
Nitin P.
Thats all.
Currently I just disable the script for a while to avoid this issue. Until maybe other further notice or info.
-
Now 0.9.8.1243 on the fast track (not Stable/2 weeks tested).
-
This is all hapening because someone from Dev Team went rogue.
check new posts.
-
/usr/local/cwpsrv/htdocs/resources/scripts/update_cwp and I get the new file temp_hacker_check updated (fixed) and version of cwpsrv: 1.15.10
Now there is an error on the script fix_cwpsrv_logs with syntax error on line 11 (missed semicolon at the end and more things the cwpsrv can't restart but stay active.
I opened a ticket, waiting for fix
-
Now at 0.9.8.1244. Rapid update with small fixes.