Recent Posts
31
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by adrianofnatal on September 21, 2026, 09:09:00 PM »Never worked after some update around 0.9.xxx.
I use S3.
Manually works, upload to S3.
Scheduled does not work.
I use S3.
Manually works, upload to S3.
Scheduled does not work.
32
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Freespirits_GR_Host on September 19, 2026, 10:59:15 PM »That's an interesting finding, particularly because those accounts don't have active WordPress installations and the requests came from an IP you don't recognize.
Since you're already using Falco, I'd correlate the timestamp of those requests with several other persistence areas rather than concentrating only on the generated cwp_login_* files.
I'd check for unexpected systemd services/timers, cron entries, SSH keys, recently created executables, unusual listening processes/ports and modifications around the same timestamp. I'd also search the other CWP accounts for the same filenames and activity pattern. If the same IOC appears across unrelated accounts, that becomes particularly valuable evidence.
I've been working on exactly this problem on my own CWP servers because manually correlating all these checks takes a huge amount of time. I eventually developed a CWP7 Security Audit Module that automates the checks and exposes the evidence inside CWP. Full disclosure: I'm the developer.
In your particular case, though, I'd be especially interested in comparing the creation timestamps of those cwp_login_* files against systemd/cron/process activity. That could help distinguish a vulnerable CWP function being called remotely from persistence already present elsewhere on the server.
Since you're already using Falco, I'd correlate the timestamp of those requests with several other persistence areas rather than concentrating only on the generated cwp_login_* files.
I'd check for unexpected systemd services/timers, cron entries, SSH keys, recently created executables, unusual listening processes/ports and modifications around the same timestamp. I'd also search the other CWP accounts for the same filenames and activity pattern. If the same IOC appears across unrelated accounts, that becomes particularly valuable evidence.
I've been working on exactly this problem on my own CWP servers because manually correlating all these checks takes a huge amount of time. I eventually developed a CWP7 Security Audit Module that automates the checks and exposes the evidence inside CWP. Full disclosure: I'm the developer.
In your particular case, though, I'd be especially interested in comparing the creation timestamps of those cwp_login_* files against systemd/cron/process activity. That could help distinguish a vulnerable CWP function being called remotely from persistence already present elsewhere on the server.
33
CentOS-WebPanel Bugs / Re: CVE-2025-48703 + CVE-2026-57517: the gsocket systemd backdoor CWP's
« Last post by Freespirits_GR_Host on September 19, 2026, 10:55:09 PM »Sorry to hear you were affected too. With this type of CWP compromise I would be careful about treating removal of the visible payload as confirmation that the server is clean.
I would check persistence separately: systemd units, cron entries, SSH authorized_keys, unexpected executables, suspicious listening ports/processes, /etc/ld.so.preload, unusual recently modified files and known IOC filenames. I would also compare the same checks across all three servers, because differences between an affected and apparently clean server can be extremely useful.
This exact problem — having to manually investigate all of these areas every time something suspicious happens — is actually why I developed my CWP7 Security Audit Module. Full disclosure: I'm the developer of it. It performs these CWP-focused checks and presents the evidence through the CWP GUI so an administrator can investigate much faster.
Even without using my module, though, I would definitely perform the persistence checks above before considering an affected machine clean.
I would check persistence separately: systemd units, cron entries, SSH authorized_keys, unexpected executables, suspicious listening ports/processes, /etc/ld.so.preload, unusual recently modified files and known IOC filenames. I would also compare the same checks across all three servers, because differences between an affected and apparently clean server can be extremely useful.
This exact problem — having to manually investigate all of these areas every time something suspicious happens — is actually why I developed my CWP7 Security Audit Module. Full disclosure: I'm the developer of it. It performs these CWP-focused checks and presents the evidence through the CWP GUI so an administrator can investigate much faster.
Even without using my module, though, I would definitely perform the persistence checks above before considering an affected machine clean.
34
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by clight77 on September 19, 2026, 06:15:41 PM »Nope it is not saving the password.
I put in my password every afternoon and update it then my BU works while I sleep, then it is rinse and repeat everyday.
I put in my password every afternoon and update it then my BU works while I sleep, then it is rinse and repeat everyday.
35
Updates / Re: Unable to load dynamic library 'intl'
« Last post by Starburst on September 19, 2026, 02:02:52 AM »If that doesn't work, Sandeep has published a different fix at:
https://www.alphagnu.com/topic/632-update-roundcube-and-fix-php-intl-extension-in-cwp/#comment-1482
https://www.alphagnu.com/topic/632-update-roundcube-and-fix-php-intl-extension-in-cwp/#comment-1482
36
Updates / Re: Unable to load dynamic library 'intl'
« Last post by Martins-phpbb on September 18, 2026, 06:38:14 PM »37
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by vox on September 18, 2026, 02:46:37 AM »Backup not working again. CWPpro version: 1.14
38
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by xenios on September 16, 2026, 04:00:45 PM »Destination: FTP server
39
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by josemnunez on September 16, 2026, 03:07:34 PM »Hello, do you have an open ticket for this issue? In which scenario is it not working—local, NFS, or Amazon?
40
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by xenios on September 16, 2026, 06:04:56 AM »With 1.14 it stopped working. Nice!
