Recent Posts
31
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by murad99 on August 27, 2026, 11:49:07 PM »I can't keep up with CVE's for WordPress, and gave up.
But as long as you keep Apache updated, and have Mod Security installed, running the latest OWASP rules, you should be OK for the most part.
Unless again, WordPress or a WordPress plugin allows something in.
CWP hasn't had a CVE since last year (CVE-2025-67888), which was fixed with 0.9.8.1209
CVE-2025-48703 was fixed in 0.9.8.1205
There are 16 CVE's that just came out today (2026-08-27) for OpenSSL:
CVE-2026-81683
CVE-2026-81700
CVE-2026-81701
CVE-2026-81702
CVE-2026-81707
CVE-2026-81704
CVE-2026-81705
CVE-2026-81706
CVE-2026-81714
CVE-2026-81715
CVE-2026-81716
CVE-2026-81717
CVE-2026-81718
CVE-2026-81719
CVE-2026-81720
CVE-2026-81721
And 3 for Plesk:
CVE-2026-65642 (Allows you to gain access to other users databases)
CVE-2026-65646
CVE-2026-65647 (Allows code to be run as root)
Thank you, Starburst, for taking the time to look into this and for sharing your insights.
If you ever need help with anything here, I’m sure many people on this forum would be more than happy to help. Just start a thread and see what happens.
32
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Starburst on August 27, 2026, 08:34:07 PM »Hmm what was going down in November? Been many challenges in 2026 I can't remember.
Search says this was current then CVE-2025-48703
These where the 2 last CVE's for CWP in 2025:
CVE-2025-67888 was fixed with 0.9.8.1209
CVE-2025-48703 was fixed in 0.9.8.1205
33
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Starburst on August 27, 2026, 08:29:28 PM »I can't keep up with CVE's for WordPress, and gave up.
But as long as you keep Apache updated, and have Mod Security installed, running the latest OWASP rules, you should be OK for the most part.
Unless again, WordPress or a WordPress plugin allows something in.
CWP hasn't had a CVE since last year (CVE-2025-67888), which was fixed with 0.9.8.1209
CVE-2025-48703 was fixed in 0.9.8.1205
There are 16 CVE's that just came out today (2026-08-27) for OpenSSL:
CVE-2026-81683
CVE-2026-81700
CVE-2026-81701
CVE-2026-81702
CVE-2026-81707
CVE-2026-81704
CVE-2026-81705
CVE-2026-81706
CVE-2026-81714
CVE-2026-81715
CVE-2026-81716
CVE-2026-81717
CVE-2026-81718
CVE-2026-81719
CVE-2026-81720
CVE-2026-81721
And 3 for Plesk:
CVE-2026-65642 (Allows you to gain access to other users databases)
CVE-2026-65646
CVE-2026-65647 (Allows code to be run as root)
But as long as you keep Apache updated, and have Mod Security installed, running the latest OWASP rules, you should be OK for the most part.
Unless again, WordPress or a WordPress plugin allows something in.
CWP hasn't had a CVE since last year (CVE-2025-67888), which was fixed with 0.9.8.1209
CVE-2025-48703 was fixed in 0.9.8.1205
There are 16 CVE's that just came out today (2026-08-27) for OpenSSL:
CVE-2026-81683
CVE-2026-81700
CVE-2026-81701
CVE-2026-81702
CVE-2026-81707
CVE-2026-81704
CVE-2026-81705
CVE-2026-81706
CVE-2026-81714
CVE-2026-81715
CVE-2026-81716
CVE-2026-81717
CVE-2026-81718
CVE-2026-81719
CVE-2026-81720
CVE-2026-81721
And 3 for Plesk:
CVE-2026-65642 (Allows you to gain access to other users databases)
CVE-2026-65646
CVE-2026-65647 (Allows code to be run as root)
34
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by murad99 on August 27, 2026, 06:47:47 PM »@murad99
Is there a reason you are still running CentOS 7, a past EOL OS?
That alone is a massive security hole.
The past several weeks they have been Kernel updates almost every other day, at least for AL9 and AL10.
But to close some of the security holes, I would updated your:
Base PHP to at least 8.3.33 and the PHP-FPM for the websites. (I'm glad CWP finally got PHP updated)
Apache is at 2.4.68
Nginx is at 1.30.4
jQuery has several notable past Common Vulnerabilities and Exposures (CVEs) related to Cross-Site Scripting (XSS) and DOM manipulation.
(There are 137 entries just for jQuery)
That's not counting the CVE's for CentOS 7, Apache <2.4.68, Nginx <1.30 and PHP <8.3.33
Our AlmaLinux 9 servers are all OK.
But we try to keep everything updated on the server side, unfortunately that doesn't work with some users. :/
As I mentioned at the beginning of this thread, I observed the same issue on two different CWP servers, and one of those servers was running AlmaLinux 9.
I agree that the older versions on my CentOS 7 server are my responsibility, and I am not trying to argue otherwise. However, I want to emphasize that I also found the same injected jQuery files on an AlmaLinux 9 server.
I am not particularly concerned about my own server in this case; I decided to report the issue publicly because I believe there may be something worth investigating.
I have shared what I found. The interpretation and conclusion are ultimately up to the CWP team and the community.
One more thing I would like to mention: it appears that registering on the forum with a Gmail address is currently not working, as the confirmation email does not arrive. This may give the impression that forum registration is disabled. There may be other users experiencing the same issue who are currently unable to report their findings or ask for help here.
I thought it was worth mentioning this as well.
35
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by audept on August 27, 2026, 01:03:52 PM »In response to overseer ... Big Thanks for the advice!..:..
Trying to add to the forum here as well.
Added the following conf file into the log rotation tool
/usr/local/cwpsrv/logs/*_log {
daily
missingok
notifempty
rotate 14
compress
delaycompress
copytruncate
}
This is tested and working. Use/edit it at your own risk Notice the copytruncate at the end...learned the hard way that was needed, without it the the cwp process seemed to hold the file and continued writing into the copied file, not a good thing., The log rotation cron then did not create the log file. I am guessing that with a service bounce the original log file would be created.
Hope that this helps someone
Trying to add to the forum here as well.
The access_log was over 3 gbs in size.My advice:
...
Is it safe to delete these two periodically on my own?Code: [Select]truncate -s0 /usr/local/cwpsrv/logs/access_logThen look at File Management > Logrotate Manager and add a rotation job for those files.
truncate -s0 /usr/local/cwpsrv/logs/error_log
Added the following conf file into the log rotation tool
/usr/local/cwpsrv/logs/*_log {
daily
missingok
notifempty
rotate 14
compress
delaycompress
copytruncate
}
This is tested and working. Use/edit it at your own risk
Notice the copytruncate at the end...learned the hard way that was needed, without it the the cwp process seemed to hold the file and continued writing into the copied file, not a good thing., The log rotation cron then did not create the log file. I am guessing that with a service bounce the original log file would be created.Hope that this helps someone
36
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by 6Sense on August 27, 2026, 06:27:58 AM »Hmm what was going down in November? Been many challenges in 2026 I can't remember.
Search says this was current then CVE-2025-48703
Search says this was current then CVE-2025-48703
37
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Netino on August 27, 2026, 04:00:19 AM »There are two vulnerabilities listed in this thread: one for WordPress and another for CWP.
Note that in the case of the file `/usr/local/cwpsrv/htdocs/admin/design/img/ico.php`, the file was made immutable—something that is really only possible with root access.
The file is in one of my servers, and have the following listing:
Note that in the case of the file `/usr/local/cwpsrv/htdocs/admin/design/img/ico.php`, the file was made immutable—something that is really only possible with root access.
The file is in one of my servers, and have the following listing:
Code: [Select]
-rw-r--r-- 1 root root 1477 nov 28 2025 ico.php
# stat ico.php
File: ico.php
Size: 1477 Blocks: 8 IO Block: 4096 regular file
Device: fd01h/64769d Inode: 2892154 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-08-25 10:26:44.985182886 -0300
Modify: 2025-11-28 06:17:52.883868313 -0300
Change: 2026-08-24 21:59:57.435060346 -0300
Birth: 2025-11-15 08:06:12.856741480 -0300
38
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Starburst on August 26, 2026, 05:53:18 PM »CWP shows it has Apache 2.4.68 in AL8 and AL9.
2.4.62 is the latest for CentOS 7.
These can be manually updated, which is what we do.
It's like 5 lines of commands.
Not sure if some of the libraries are still there though. EL7 support has been ended for allot of packages.
We also have Apache enabled for HTTP/2, which the stock one doesn't have an option for.
But again, curious why you are running a way past EOL CentOS 7 OS that has major security holes in it?
I know it's a pain to upgrade, we all have been there.
But again, running an EOL OS, you can expect security breaches.
If you need a CWPpro license temporarily to upgrade to AL8 or AL9 (I would recommend AL9), let me know.
2.4.62 is the latest for CentOS 7.
These can be manually updated, which is what we do.
It's like 5 lines of commands.
Not sure if some of the libraries are still there though. EL7 support has been ended for allot of packages.
We also have Apache enabled for HTTP/2, which the stock one doesn't have an option for.
But again, curious why you are running a way past EOL CentOS 7 OS that has major security holes in it?
I know it's a pain to upgrade, we all have been there.
But again, running an EOL OS, you can expect security breaches.
If you need a CWPpro license temporarily to upgrade to AL8 or AL9 (I would recommend AL9), let me know.
39
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by kandalf on August 26, 2026, 03:33:07 PM »CWP team must update the base Apache and NGINX for everyone, this is urgent.
40
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Starburst on August 26, 2026, 12:49:23 PM »@murad99
Is there a reason you are still running CentOS 7, a past EOL OS?
That alone is a massive security hole.
The past several weeks they have been Kernel updates almost every other day, at least for AL9 and AL10.
But to close some of the security holes, I would updated your:
Base PHP to at least 8.3.33 and the PHP-FPM for the websites. (I'm glad CWP finally got PHP updated)
Apache is at 2.4.68
Nginx is at 1.30.4
jQuery has several notable past Common Vulnerabilities and Exposures (CVEs) related to Cross-Site Scripting (XSS) and DOM manipulation.
(There are 137 entries just for jQuery)
That's not counting the CVE's for CentOS 7, Apache <2.4.68, Nginx <1.30 and PHP <8.3.33
Our AlmaLinux 9 servers are all OK.
But we try to keep everything updated on the server side, unfortunately that doesn't work with some users. :/
Is there a reason you are still running CentOS 7, a past EOL OS?
That alone is a massive security hole.
The past several weeks they have been Kernel updates almost every other day, at least for AL9 and AL10.
But to close some of the security holes, I would updated your:
Base PHP to at least 8.3.33 and the PHP-FPM for the websites. (I'm glad CWP finally got PHP updated)
Apache is at 2.4.68
Nginx is at 1.30.4
jQuery has several notable past Common Vulnerabilities and Exposures (CVEs) related to Cross-Site Scripting (XSS) and DOM manipulation.
(There are 137 entries just for jQuery)
That's not counting the CVE's for CentOS 7, Apache <2.4.68, Nginx <1.30 and PHP <8.3.33
Our AlmaLinux 9 servers are all OK.
But we try to keep everything updated on the server side, unfortunately that doesn't work with some users. :/
