New in CWP Edge-LatestFree with every CWPpro licenceWebsites up to 300x faster
Get CWPpro ›
CWP now includes LSPHP, LSCache and CWP CageFS at no extra cost with all CWPpro licences. The LSCache plugin is integrated into our WordPress and other script installers, and CWP CageFS gives every user complete isolation. Available now in the CWP Edge-Latest version.
Recent posts
#31
Updates / CWP New Version Released 2.0.3...
Last post by Administrator - November 12, 2026, 09:17:51 AMCWP 2.0.3 (Edge) – changes since 2.0.2
The Edge channel ships new features early. It also includes every fix from the
current LTS release (1.30.9 – see the LTS changelog). New in 2.0.3:
Features
CWP Cage (resource limits):
- CloudLinux-style per-account resource limits. Each hosting account can be given CPU (%), memory, process and I/O limits, enforced with Linux cgroups, and the account's PHP runs isolated through the CWP lsPHP handler (cwpsapi). Limits can be set per package (every account on the package inherits them) or overridden per account, and legacy cgroups settings are imported automatically. The Cage live view shows real per-account CPU/memory usage, busiest accounts first. (CWPpro)
lsPHP per domain (PHP Selector):
- When an account is enabled for lsPHP, its PHP Selector now offers an "lsPHP" option next to Default / Selector CGI / Selector FPM, so a single domain can be switched to the high-performance lsPHP handler on a chosen PHP version. The option appears only on CWPpro servers with the handler installed and the account enabled for it; every other account looks and works exactly as before.
Fixes
Migration (external panels):
- The DNS import no longer corrupts records: a record's type is no longer glued onto its value (A/CNAME/MX records imported cleanly), and long quoted TXT records (SPF, BIMI) are no longer truncated at the first semicolon. In addition, A/AAAA records that point at the old server's IP are now repointed to the new server — including wildcard and subdomain records — so mail and web for every subdomain land on the new server after a migration instead of the decommissioned one.
Cloudflare (user panel):
- Input hardening on the module entry point.
Plus all fixes from LTS 1.30.9.
The Edge channel ships new features early. It also includes every fix from the
current LTS release (1.30.9 – see the LTS changelog). New in 2.0.3:
Features
CWP Cage (resource limits):
- CloudLinux-style per-account resource limits. Each hosting account can be given CPU (%), memory, process and I/O limits, enforced with Linux cgroups, and the account's PHP runs isolated through the CWP lsPHP handler (cwpsapi). Limits can be set per package (every account on the package inherits them) or overridden per account, and legacy cgroups settings are imported automatically. The Cage live view shows real per-account CPU/memory usage, busiest accounts first. (CWPpro)
lsPHP per domain (PHP Selector):
- When an account is enabled for lsPHP, its PHP Selector now offers an "lsPHP" option next to Default / Selector CGI / Selector FPM, so a single domain can be switched to the high-performance lsPHP handler on a chosen PHP version. The option appears only on CWPpro servers with the handler installed and the account enabled for it; every other account looks and works exactly as before.
Fixes
Migration (external panels):
- The DNS import no longer corrupts records: a record's type is no longer glued onto its value (A/CNAME/MX records imported cleanly), and long quoted TXT records (SPF, BIMI) are no longer truncated at the first semicolon. In addition, A/AAAA records that point at the old server's IP are now repointed to the new server — including wildcard and subdomain records — so mail and web for every subdomain land on the new server after a migration instead of the decommissioned one.
Cloudflare (user panel):
- Input hardening on the module entry point.
Plus all fixes from LTS 1.30.9.
#32
Updates / CWP New Version Released 2.0.2...
Last post by Administrator - November 12, 2026, 09:16:42 AMCWP 2.0.2 (Edge) – changes since 2.0.1
Includes every fix from LTS 1.30.7. Edge-specific in 2.0.2:
Features
CWP Cage:
- Bulk operations and a live per-account resource view in the Cage module.
Tools:
- install_wp_cli: one-command WP-CLI install, downloaded from the CDN and checksum-verified.
- Ebury cleanup tool (/scripts/cwp_ebury_clean) plus a Security Audit check that detect and quarantine a tampered libkeyutils (the Ebury SSH credential-stealer) using a static busybox, so the check works even on a compromised host.
Fixes
Security & updates:
- Panel update/version checks and the MySQL upgrade helper now fetch over HTTPS instead of plain HTTP (closes an on-path tampering surface on root-run downloads).
- CWP Secure Kernel: UEFI boot-entry handling made consistent and the trial-boot/bootcheck rollback no longer stalls.
Mail / PHP:
- PHP mail() logging: when enabled, PHP-FPM writes the per-account log under /home/<user>/logs so it works on EL8/EL9 (and hardened EL7) where /usr is read-only.
- Webmail opens on webmail.<domain> with a matching certificate.
Backups / databases:
- Legacy backup now includes and restores each account's MongoDB databases.
- CWP-to-CWP "Sync again" no longer leaves 403 errors or duplicated mail.
- User-panel: deleting a database user no longer logs a MySQL grant-table error.
File Manager:
- Decompressing a .gz file works on EL7 again.
ModSecurity:
- Enabling ModSecurity on AlmaLinux/EL10 works (reuses the existing module instead of recompiling).
Plus the rest of the LTS 1.30.7 fixes.
Includes every fix from LTS 1.30.7. Edge-specific in 2.0.2:
Features
CWP Cage:
- Bulk operations and a live per-account resource view in the Cage module.
Tools:
- install_wp_cli: one-command WP-CLI install, downloaded from the CDN and checksum-verified.
- Ebury cleanup tool (/scripts/cwp_ebury_clean) plus a Security Audit check that detect and quarantine a tampered libkeyutils (the Ebury SSH credential-stealer) using a static busybox, so the check works even on a compromised host.
Fixes
Security & updates:
- Panel update/version checks and the MySQL upgrade helper now fetch over HTTPS instead of plain HTTP (closes an on-path tampering surface on root-run downloads).
- CWP Secure Kernel: UEFI boot-entry handling made consistent and the trial-boot/bootcheck rollback no longer stalls.
Mail / PHP:
- PHP mail() logging: when enabled, PHP-FPM writes the per-account log under /home/<user>/logs so it works on EL8/EL9 (and hardened EL7) where /usr is read-only.
- Webmail opens on webmail.<domain> with a matching certificate.
Backups / databases:
- Legacy backup now includes and restores each account's MongoDB databases.
- CWP-to-CWP "Sync again" no longer leaves 403 errors or duplicated mail.
- User-panel: deleting a database user no longer logs a MySQL grant-table error.
File Manager:
- Decompressing a .gz file works on EL7 again.
ModSecurity:
- Enabling ModSecurity on AlmaLinux/EL10 works (reuses the existing module instead of recompiling).
Plus the rest of the LTS 1.30.7 fixes.
#33
Updates / CWP New Version Released 1.30...
Last post by Administrator - November 12, 2026, 08:52:19 AMCWP 1.30.9 (LTS) – changes since 1.30.8
Fixes
Installers:
- Softaculous and Fantastico installs (WordPress and others) no longer fail with "The MySQL Connection could not be established" / "Invalid Token". The 1.30.6 security change made the local integration token single-use, but Softaculous reuses one token across the several API calls of a single install, so every call after the first was rejected. The token is now accepted for the length of its own short expiry instead of being consumed on the first call, and the path stays restricted to local callers, so installs work again with no loss of the 1.30.6 protection. (#787928)
Nightly maintenance:
- The nightly job no longer starts PHP-FPM versions you keep disabled. It was adding a monit watch for every installed PHP-FPM version, and monit then started the ones that were switched off; it now watches only the versions that are enabled in systemd. (#460699)
- The nightly AutoSSL renewal no longer emails a "cat: /usr/local/cwp/.conf/vhosts-ssl.json: No such file or directory" error (and a foreach() warning) on a fresh server that has no accounts or SSL certificates yet. A missing/empty list is now treated as "nothing to do".
- PHP extensions self-heal (follow-up to #151688): the decision is now made per scan directory across all installed PHPs, not per single binary, so a shared .ini is kept when any PHP sharing that directory can use the module (e.g. the account's web PHP loads sodium while a stray CLI php cannot). A module that no PHP can provide anywhere is still disabled.
Admin panel:
- The admin sidebar menu now shows your admin language even when another value in cwp.ini contains a special character. The menu read the whole cwp.ini with parse_ini_file(), which returns nothing for the entire file if any single value has an unquoted special character, so the language was lost and the menu fell back to English although the translation existed. The language is now read directly. (forum)
- The "CWP -> CWP Migration" page no longer opens blank with a "Call to undefined function cwp_admin_module_lang()" error. The helper the page uses was missing from the LTS function library; it is now defined. (#841893)
- "Available updates" indicator is now update-channel aware: on servers that follow the edge channel it compares against the edge version list as well, so the indicator is correct for them. Servers on the normal (LTS) channel are unaffected. (#504017)
Security (hardening):
- User-panel Cron: the account name is now escaped where it is passed to the lsattr check, as defence in depth.
Fixes
Installers:
- Softaculous and Fantastico installs (WordPress and others) no longer fail with "The MySQL Connection could not be established" / "Invalid Token". The 1.30.6 security change made the local integration token single-use, but Softaculous reuses one token across the several API calls of a single install, so every call after the first was rejected. The token is now accepted for the length of its own short expiry instead of being consumed on the first call, and the path stays restricted to local callers, so installs work again with no loss of the 1.30.6 protection. (#787928)
Nightly maintenance:
- The nightly job no longer starts PHP-FPM versions you keep disabled. It was adding a monit watch for every installed PHP-FPM version, and monit then started the ones that were switched off; it now watches only the versions that are enabled in systemd. (#460699)
- The nightly AutoSSL renewal no longer emails a "cat: /usr/local/cwp/.conf/vhosts-ssl.json: No such file or directory" error (and a foreach() warning) on a fresh server that has no accounts or SSL certificates yet. A missing/empty list is now treated as "nothing to do".
- PHP extensions self-heal (follow-up to #151688): the decision is now made per scan directory across all installed PHPs, not per single binary, so a shared .ini is kept when any PHP sharing that directory can use the module (e.g. the account's web PHP loads sodium while a stray CLI php cannot). A module that no PHP can provide anywhere is still disabled.
Admin panel:
- The admin sidebar menu now shows your admin language even when another value in cwp.ini contains a special character. The menu read the whole cwp.ini with parse_ini_file(), which returns nothing for the entire file if any single value has an unquoted special character, so the language was lost and the menu fell back to English although the translation existed. The language is now read directly. (forum)
- The "CWP -> CWP Migration" page no longer opens blank with a "Call to undefined function cwp_admin_module_lang()" error. The helper the page uses was missing from the LTS function library; it is now defined. (#841893)
- "Available updates" indicator is now update-channel aware: on servers that follow the edge channel it compares against the edge version list as well, so the indicator is correct for them. Servers on the normal (LTS) channel are unaffected. (#504017)
Security (hardening):
- User-panel Cron: the account name is now escaped where it is passed to the lsattr check, as defence in depth.
#34
Updates / CWP New Version Released 1.30....
Last post by Administrator - November 12, 2026, 08:50:36 AMCWP 1.30.8 (LTS) – changes since 1.30.7
Fixes
PHP extensions:
- The nightly "self-heal" job no longer disables a PHP extension that is actually working. A module whose .ini was present but whose .so was built statically into PHP, is a built-in, or was already loaded by that PHP, was being switched off by mistake. On servers that had built PHP 8.4/8.5 this disabled sodium and broke WordPress with a 500 error on the nightly run. The job now keeps such a module and only disables one that genuinely cannot be loaded by any PHP. (#151688)
Fix Permissions:
- "Fix Permissions" no longer overloads the server on large accounts. It used to run a full recursive chown over the whole account tree every time, which on big accounts stacked 40–70 minute jobs and hammered the disk. It now changes ownership only on the files whose owner or group is actually wrong, and takes a per-account lock so the same account cannot be fixed twice at once. (#964718)
Fixes
PHP extensions:
- The nightly "self-heal" job no longer disables a PHP extension that is actually working. A module whose .ini was present but whose .so was built statically into PHP, is a built-in, or was already loaded by that PHP, was being switched off by mistake. On servers that had built PHP 8.4/8.5 this disabled sodium and broke WordPress with a 500 error on the nightly run. The job now keeps such a module and only disables one that genuinely cannot be loaded by any PHP. (#151688)
Fix Permissions:
- "Fix Permissions" no longer overloads the server on large accounts. It used to run a full recursive chown over the whole account tree every time, which on big accounts stacked 40–70 minute jobs and hammered the disk. It now changes ownership only on the files whose owner or group is actually wrong, and takes a per-account lock so the same account cannot be fixed twice at once. (#964718)
#35
Updates / CWP New Version Released 1.30....
Last post by Administrator - November 12, 2026, 08:41:24 AMCWP 1.30.7 (LTS) – changes since 1.30.6
Fixes
Security & update channel:
- Panel update/version checks (the 3rd-party version feed and "Check for updates") and the MySQL upgrade helper now fetch over HTTPS instead of plain HTTP, closing an on-path (man-in-the-middle) tampering surface on root-run downloads.
- New "Ebury" cleanup tool (/scripts/cwp_ebury_clean) plus a Security Audit check that detect and quarantine a tampered libkeyutils (the Ebury SSH credential-stealer) using a static busybox, so the check works even on a compromised host.
- CWP Secure Kernel (/scripts/cwpsecure_kernel): UEFI boot entry handling made consistent (EFI grubenv/saved_entry) and the trial-boot / bootcheck rollback loop no longer stalls, so a Secure Kernel install cannot leave the server unbootable.
Updates & packages:
- The 8.3 PHP updater (/scripts/update_cwpphp83) now works on end-of-life CentOS 8 by pointing yum at the CentOS vault repositories instead of the dead mirrorlist.
- Dashboard "Available updates": the red alert now clears after the updates are installed (it could stay red forever), and the count refreshes correctly.
ModSecurity:
- Enabling ModSecurity on AlmaLinux/EL10 works: it reuses the existing mod_security2 module instead of trying to recompile, and re-enabling is idempotent.
PHP Defender:
- The default rules no longer break WordPress: wp-includes core requests (curl-based loopback/REST) are allowed before the strict SSL-verify drops, so WordPress sites keep working while the protections stay on.
Mail / DNS:
- Webmail now opens on webmail.<domain> with a certificate that matches the name, instead of the shared server IP/hostname that triggered a browser certificate warning.
- PHP mail logging: when it is enabled (/scripts/php_mail_log), PHP-FPM now writes the mail() log per account under /home/<user>/logs/phpmail.log instead of the shared /usr/local/apache/logs/phpmail.log. On EL8/EL9 (and hardened EL7) the PHP-FPM service runs with a read-only /usr, so the old shared path made mail() fail with "Read-only file system" and some frameworks (SMF, Laravel) then sent no mail at all; the per-account path is writable and allowed by the Secure Kernel. Plain PHP (CGI) keeps the shared log.
Backups:
- Legacy (scheduled) backup now includes each account's MongoDB databases, and restores them.
- CWP-to-CWP "Sync again": the account is no longer left with 403 errors after a sync (file/owner permissions are re-applied to every docroot), and mail that was already delivered on the destination is no longer duplicated on each re-sync.
- New Backup Manager: restoring a MONTHLY backup from an FTP destination now works (an internal period check was misspelled and never matched, so the monthly FTP restore did nothing). Daily/weekly and local/SSH restores were unaffected.
Databases (user panel):
- Deleting a database user no longer logs a MySQL "Table mysql Db doesn't exist" error (corrected to the real lowercase grant table), and unlinking a user from a database now reports success (HTTP 200) instead of 403.
- Creating a database with a user now reports the real result: if the database is made but the user cannot be created, the panel says so instead of claiming "created successfully".
File Manager:
- Decompressing a .gz file works on EL7 again (the old extractor used a gzip flag that CentOS 7's gzip does not support). ZIP and tar/tar.gz were unaffected.
Fixes
Security & update channel:
- Panel update/version checks (the 3rd-party version feed and "Check for updates") and the MySQL upgrade helper now fetch over HTTPS instead of plain HTTP, closing an on-path (man-in-the-middle) tampering surface on root-run downloads.
- New "Ebury" cleanup tool (/scripts/cwp_ebury_clean) plus a Security Audit check that detect and quarantine a tampered libkeyutils (the Ebury SSH credential-stealer) using a static busybox, so the check works even on a compromised host.
- CWP Secure Kernel (/scripts/cwpsecure_kernel): UEFI boot entry handling made consistent (EFI grubenv/saved_entry) and the trial-boot / bootcheck rollback loop no longer stalls, so a Secure Kernel install cannot leave the server unbootable.
Updates & packages:
- The 8.3 PHP updater (/scripts/update_cwpphp83) now works on end-of-life CentOS 8 by pointing yum at the CentOS vault repositories instead of the dead mirrorlist.
- Dashboard "Available updates": the red alert now clears after the updates are installed (it could stay red forever), and the count refreshes correctly.
ModSecurity:
- Enabling ModSecurity on AlmaLinux/EL10 works: it reuses the existing mod_security2 module instead of trying to recompile, and re-enabling is idempotent.
PHP Defender:
- The default rules no longer break WordPress: wp-includes core requests (curl-based loopback/REST) are allowed before the strict SSL-verify drops, so WordPress sites keep working while the protections stay on.
Mail / DNS:
- Webmail now opens on webmail.<domain> with a certificate that matches the name, instead of the shared server IP/hostname that triggered a browser certificate warning.
- PHP mail logging: when it is enabled (/scripts/php_mail_log), PHP-FPM now writes the mail() log per account under /home/<user>/logs/phpmail.log instead of the shared /usr/local/apache/logs/phpmail.log. On EL8/EL9 (and hardened EL7) the PHP-FPM service runs with a read-only /usr, so the old shared path made mail() fail with "Read-only file system" and some frameworks (SMF, Laravel) then sent no mail at all; the per-account path is writable and allowed by the Secure Kernel. Plain PHP (CGI) keeps the shared log.
Backups:
- Legacy (scheduled) backup now includes each account's MongoDB databases, and restores them.
- CWP-to-CWP "Sync again": the account is no longer left with 403 errors after a sync (file/owner permissions are re-applied to every docroot), and mail that was already delivered on the destination is no longer duplicated on each re-sync.
- New Backup Manager: restoring a MONTHLY backup from an FTP destination now works (an internal period check was misspelled and never matched, so the monthly FTP restore did nothing). Daily/weekly and local/SSH restores were unaffected.
Databases (user panel):
- Deleting a database user no longer logs a MySQL "Table mysql Db doesn't exist" error (corrected to the real lowercase grant table), and unlinking a user from a database now reports success (HTTP 200) instead of 403.
- Creating a database with a user now reports the real result: if the database is made but the user cannot be created, the panel says so instead of claiming "created successfully".
File Manager:
- Decompressing a .gz file works on EL7 again (the old extractor used a gzip flag that CentOS 7's gzip does not support). ZIP and tar/tar.gz were unaffected.
#36
CentOS-WebPanel Bugs / phpMyAdmin auto-login failed
Last post by anandmys - November 12, 2026, 08:04:20 AMCWPpro version: 2.0.2
I get the error message
There is no mysql user by name ayurveda shown in the control panel
All mysql users start with ayurveda_ (user account derived)
Not sure how to fix this issue
I get the error message
QuoteThe MySQL user ayurveda does not accept your control panel password - the two passwords were changed separately. Set the MySQL password of ayurveda to your panel password in MySQL Manager (change password), or log in to phpMyAdmin with the MySQL password you use for it.
There is no mysql user by name ayurveda shown in the control panel
All mysql users start with ayurveda_ (user account derived)
Not sure how to fix this issue
#37
Updates / Re: CWP New Version Released 2...
Last post by anandmys - November 12, 2026, 05:02:33 AMQuote[root@server ~]# sh /scripts/update_cwp
====================================================
============= CentOS Web Panel Cron ================
====================================================
###########################
Firewall Flush Daily Blocks
###########################
######################
Update Server Packages
######################
Redirecting to /bin/systemctl restart cwpsrv.service
Redirecting to /bin/systemctl restart cwp-phpfpm.service
Redirecting to /bin/systemctl reload cwpsrv.service
Redirecting to /bin/systemctl reload cwp-phpfpm.service
Redirecting to /bin/systemctl reload httpd.service
warning: /var/tmp/rpm-tmp.7S9uMv: Header V4 RSA/SHA1 Signature, key ID fd087ba9: NOKEY
error: Failed dependencies:
postfix = 2:3.5.8-8.el8_10 is needed by (installed) postfix-mysql-2:3.5.8-8.el8_10.x86_64
Redirecting to /bin/systemctl reload httpd.service
[root@server ~]#
#38
Other / Re: CVE-2026-123872 - Node.js ...
Last post by 6Sense - November 11, 2026, 11:16:20 PMThanks mate, all patched now 
#39
Other / CVE-2026-123872 - Node.js is v...
Last post by Starburst - November 11, 2026, 10:22:42 PMCVE ID :CVE-2026-123872
Published : Nov. 11, 2026, 6:30 p.m. | 35 minutes ago
Description :A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity: 8.1 | HIGH
More Information:
https://cvefeed.io/vuln/detail/CVE-2026-123872
Published : Nov. 11, 2026, 6:30 p.m. | 35 minutes ago
Description :A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiation to reach endpoints it was not authorized for. On a server that applies different client-certificate policies per hostname, for example stricter admin-only client-cert auth on one host and ordinary client-cert auth on another, a client that authenticates for a permitted host can renegotiate the TLS 1.2 connection under a different servername and carry its existing authentication to the protected host, bypassing the stricter policy. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
Severity: 8.1 | HIGH
More Information:
https://cvefeed.io/vuln/detail/CVE-2026-123872
#40
Apache / CVE-2026-119618 - Apache HTTP ...
Last post by Starburst - November 11, 2026, 05:42:13 PMIf you are using Apache with mod_http2:
CVE-2026-119618 - Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Hopefully Apache will release 2.4.71 soon.
CVE-2026-119618 - Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers
Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.
Hopefully Apache will release 2.4.71 soon.