Messages

1

Other / Re: Forum improvement

« on: Today at 12:34:39 AM »

Let's hope so! It's been ongoing for too long...

2

Information / Re: End of life for CWP6

« on: Today at 12:33:00 AM »

GOOD! And good riddance to EOL OSes!

3

Updates / Re: I am trying to update via CWP, but...?!?

« on: July 23, 2026, 02:27:50 PM »

Sorry, not enough info showing in that screenshot. Can you paste in the full errors (and command that produced it)?

4

Other / Re: hacker_cleanup.log

« on: July 23, 2026, 02:24:33 PM »

That's a remnant of the CWP hacker cleanup script. It is perfectly normal and would be good to review those logs to make sure your server is successfully cleaned. I would be more concerned about its absence -- are those other servers up to date and clean of any IOC?

5

CentOS-WebPanel Bugs / Re: CVE-2025-48703 + CVE-2026-57517: the gsocket systemd backdoor CWP's

« on: July 23, 2026, 02:14:10 PM »

I have removed 3 entries from /etc/hosts
127.0.0.1 mya.cloudsyndication.org
127.0.0.1 gsocket.io
127.0.0.1 www.gsocket.io

Those entries are intentional, created by the CWP cleanup script -- they blackhole the known C&C infrastructure of the hackers. Best to leave them in place.

6

CentOS-WebPanel Bugs / Re: Test page centos hijack my facebook...

« on: July 21, 2026, 06:18:26 PM »

Also, you can change your Index directive in Apache or Nginx. I always set it to just index.php (removing index.html and index.htm) unless it is for a static HTML site (much more rarely these days).

7

CentOS-WebPanel Bugs / Re: CVE-2025-48703 + CVE-2026-57517: the gsocket systemd backdoor CWP's

« on: July 21, 2026, 06:15:35 PM »

The main thread regarding the gsocket hacking should have most of the details you need. Also the CWP-provided script should do a lot for you automatically. Do you need help cleaning up your server?

8

Installation / Re: CWP Fresh install on Almalinux 9 Error root login

« on: July 13, 2026, 02:14:59 PM »

Is your data center image based on the full/DVD installer, or the minimal install? You need a full install, not minimal.

9

Other / Re: New CVEs in Linux Kernel: CVE-2026-53359, CVE-2026-46242, CVE-2026-43499

« on: July 10, 2026, 03:14:05 AM »

Let the summer of AI fuzzing continue!

10

CentOS-WebPanel Bugs / Re: CVE-2025-48703 + CVE-2026-57517: the gsocket systemd backdoor CWP's

« on: July 08, 2026, 02:43:22 PM »

Changing SSH port is imperative IMO.

Definitely don't run on port 22, and even 2222 is not safe from FritzFrog:
https://arstechnica.com/information-technology/2022/02/after-lying-low-ssh-botnet-mushrooms-and-is-harder-than-ever-to-take-down/

11

CentOS-WebPanel Bugs / Re: CVE-2025-48703 + CVE-2026-57517: the gsocket systemd backdoor CWP's

« on: July 08, 2026, 03:03:48 AM »

None of my servers were hit. Probably because I'm running low on the radar to script kiddies, worms, and Shodan.
https://azdigi.com/en/blog/webserver-panel/centos-web-panel/how-to-change-the-port-on-centos-web-panel-cwp
https://wiki.centos-webpanel.com/how-to-change-ssh-port

12

Updates / Re: Dev Team went rogue ?

« on: July 07, 2026, 01:34:34 PM »

I read the script. Your theory is definitely worthy of Ian Flemming. Refutation straight from the Administrator's keyboard:

Dev Team Member went Rogue and start Hacking CWPro servers, thats why the updates.

nope, only new hackers with AI are now attacking...but we solve them.

13

CentOS-WebPanel Bugs / Re: CVE-2025-48703 + CVE-2026-57517: the gsocket systemd backdoor CWP's

« on: July 07, 2026, 01:29:32 PM »

Thanks, but maybe some introductions are in order...

14

Updates / Re: update 0.9.8.1239 remove all users database + postfix acc

« on: July 07, 2026, 02:07:10 AM »

Now at 0.9.8.1244. Rapid update with small fixes.

15

Other / Re: Yanz Webshell! - PRIV8 WEB SHELL ORB YANZ BYPASS! V3.0

« on: July 06, 2026, 07:38:30 PM »

But the sky is falling... you're aware of that, right? The sky is falling! The sky is falling!