Recent Posts
21
MySQL / Could not connect: Connection refused (internal server error 500)
« Last post by zeejdeej on September 11, 2026, 12:42:16 AM »hello,
i keep getting Could not connect: Connection refused (internal server error 500) on all sites including cwp admin and user panel and after restart everything works fine. what could be the issue if anyone faced this issue before in cwp . how to fix it ?
this is what i get when i try to access cwp admin panel. all other hosted websites show internal server error 500 . but everything is fine after mysql server restart .
-----------------------------------------------------------------------------------------
Trying to start mysql server, please wait!
Try to restart Control Web Panel with command: sh /scripts/restart_cwpsrv
**Check your MySQL root password in: /usr/local/cwpsrv/htdocs/resources/admin/include/db_conn.php and /root/.my.cnf
You can reset the MySQL root password fast with this command: /scripts/mysql_pwd_reset -q
Could not connect: Connection refused
i keep getting Could not connect: Connection refused (internal server error 500) on all sites including cwp admin and user panel and after restart everything works fine. what could be the issue if anyone faced this issue before in cwp . how to fix it ?
this is what i get when i try to access cwp admin panel. all other hosted websites show internal server error 500 . but everything is fine after mysql server restart .
-----------------------------------------------------------------------------------------
Trying to start mysql server, please wait!
Try to restart Control Web Panel with command: sh /scripts/restart_cwpsrv
**Check your MySQL root password in: /usr/local/cwpsrv/htdocs/resources/admin/include/db_conn.php and /root/.my.cnf
You can reset the MySQL root password fast with this command: /scripts/mysql_pwd_reset -q
Could not connect: Connection refused
22
DNS Manager / Meet a girl who'll surprise and delight
« Last post by 500wordsessay on September 10, 2026, 11:03:40 PM »23
Information / Re: New security issue? 09.09.2026
« Last post by y0 on September 10, 2026, 09:28:02 PM »this might help https://github.com/sminozzi/casino-seo-poisoning-guide
hacker probably still has an access to server through infected/fake process and/or cronjobs, Ive used gemini to solve this problem
you can start with checking who is connected to your server right now with following command:
you will see something like this:
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2927707/nginx: work
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2975254/dovecot/ima
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2212967/dovecot/ima
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2945502/sshd: root
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2928151/cwpsrv: wor
look for "cwpserv" and "sshd". other ones like dovecot, nginx etc are usually fine, if *IP* is unknown to you then I suggest you to kill the connection and ban the IP
then you can check for deleted processes:
hacker probably still has an access to server through infected/fake process and/or cronjobs, Ive used gemini to solve this problem
you can start with checking who is connected to your server right now with following command:
Code: [Select]
netstat -antp | grep -E "ESTABLISHED|LISTEN"you will see something like this:
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2927707/nginx: work
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2975254/dovecot/ima
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2212967/dovecot/ima
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2945502/sshd: root
tcp 0 0 *IP*:*PORT* *IP*:*PORT* ESTABLISHED 2928151/cwpsrv: wor
look for "cwpserv" and "sshd". other ones like dovecot, nginx etc are usually fine, if *IP* is unknown to you then I suggest you to kill the connection and ban the IP
then you can check for deleted processes:
Code: [Select]
ls -al /proc/*/exe 2> /dev/null | grep 'deleted'if have any output then its probably is infected process which was used by hacker to get access, use gemini or w/e AI for further steps, you need to find where this process came from and delete files24
Backup / Re: NEW Backup (beta) / Restore Account -> Does not list accounts to restore
« Last post by DA_MAN on September 10, 2026, 06:42:18 PM »I have done quite a bit more troubleshooting on this and can confirm that the S3 restore problem occurs before CWP ever attempts to connect to the S3 server.
My setup is AlmaLinux 9.8 using the New Backup (beta) system. Local restore is working now, but S3 restore still does not populate the Frequency, Backup, or User Accounts fields.
The S3 storage is a Garage S3-compatible server. Backups to it are working normally.
I verified the following:
* The backup archives are present in the S3 bucket in the expected structure, for example:
`full/daily/Sunday/accounts/user.tar.gz`
* Using the same endpoint, bucket, region, access key and secret key stored in CWP's backup configuration, `aws s3 ls` successfully lists the bucket, directories and account backup files.
* CWP itself successfully uploads backups to this same S3 bucket.
* The CWP AJAX request for `searchbackupaccount` returns HTTP 200, but the response is only 5 bytes when S3 is selected. The equivalent Local request returns 82 bytes and the restore selections populate normally.
* There are no corresponding errors recorded in the CWP backup `errors` or `restore` SQLite tables.
* I ran tcpdump while selecting the S3 restore source. CWP made no connection at all to the configured S3 server.
* I then traced the CWP PHP-FPM process. During the S3 restore request CWP reads `/usr/local/cwp/.conf/backup_config.sqlite` and checks that the AWS CLI is installed with `which aws`.
* CWP finds `/usr/bin/aws`, but it never executes an `aws` command after that check.
* Since no AWS command is executed and no network connection is made to the S3 server, the restore code appears to stop locally before it ever attempts to enumerate the S3 bucket.
I also compared the working Local backup configuration with the S3 configuration and tested the few potentially relevant differences. Changing `S3_PATH` from an empty value to the database default of `0` made no difference. I also tested `DEFAULUSERBACKUP=0` instead of `1`, with no difference. Both values were restored to their original settings after testing.
At this point I don't believe this is an S3 credentials, permissions, endpoint, network, or AWS CLI problem. All of those work when tested directly, and CWP is successfully writing backups to the same bucket.
It appears that the New Backup (beta) S3 restore discovery code is returning before it ever attempts to access S3.
Hopefully this additional information will help locate the problem.
My setup is AlmaLinux 9.8 using the New Backup (beta) system. Local restore is working now, but S3 restore still does not populate the Frequency, Backup, or User Accounts fields.
The S3 storage is a Garage S3-compatible server. Backups to it are working normally.
I verified the following:
* The backup archives are present in the S3 bucket in the expected structure, for example:
`full/daily/Sunday/accounts/user.tar.gz`
* Using the same endpoint, bucket, region, access key and secret key stored in CWP's backup configuration, `aws s3 ls` successfully lists the bucket, directories and account backup files.
* CWP itself successfully uploads backups to this same S3 bucket.
* The CWP AJAX request for `searchbackupaccount` returns HTTP 200, but the response is only 5 bytes when S3 is selected. The equivalent Local request returns 82 bytes and the restore selections populate normally.
* There are no corresponding errors recorded in the CWP backup `errors` or `restore` SQLite tables.
* I ran tcpdump while selecting the S3 restore source. CWP made no connection at all to the configured S3 server.
* I then traced the CWP PHP-FPM process. During the S3 restore request CWP reads `/usr/local/cwp/.conf/backup_config.sqlite` and checks that the AWS CLI is installed with `which aws`.
* CWP finds `/usr/bin/aws`, but it never executes an `aws` command after that check.
* Since no AWS command is executed and no network connection is made to the S3 server, the restore code appears to stop locally before it ever attempts to enumerate the S3 bucket.
I also compared the working Local backup configuration with the S3 configuration and tested the few potentially relevant differences. Changing `S3_PATH` from an empty value to the database default of `0` made no difference. I also tested `DEFAULUSERBACKUP=0` instead of `1`, with no difference. Both values were restored to their original settings after testing.
At this point I don't believe this is an S3 credentials, permissions, endpoint, network, or AWS CLI problem. All of those work when tested directly, and CWP is successfully writing backups to the same bucket.
It appears that the New Backup (beta) S3 restore discovery code is returning before it ever attempts to access S3.
Hopefully this additional information will help locate the problem.
25
Information / The impact of AI tools and our commitment to CWP
« Last post by josemnunez on September 10, 2026, 03:23:12 PM »Dear Community:
We would like to share an open update regarding the current security landscape we are managing.
Over the past few months, the hosting and control panel ecosystem has seen a dramatic rise in vulnerability reports and automated scanning activity. With the proliferation of AI-driven tools, cybersecurity firms, independent researchers, and malicious actors alike are leveraging AI to conduct massive audits and identify attack vectors at unprecedented speeds. This situation is not unique to CWP; it affects the entire industry.
In light of this new landscape, we want to reassure you about our ongoing efforts:
Rapid response and mitigation: We analyze every report we receive—whether from security firms or the community—and deploy patches as quickly as possible.
Continuous core development: The CWP development team works daily to reinforce the code and adapt our defenses to neutralize these modern, AI-powered automated scanning methods.
Gratitude to the community: Your role is vital. We want to thank all the users and administrators who remain vigilant and actively collaborate with us.
We remind you of the importance of keeping your servers and services updated to the latest available version. If you detect any anomalous behavior, bugs, or potential security flaws, please notify us immediately through official channels so we can assess the issue with the highest priority.
Thank you for your continued support and trust as we work to strengthen the platform every day.
We would like to share an open update regarding the current security landscape we are managing.
Over the past few months, the hosting and control panel ecosystem has seen a dramatic rise in vulnerability reports and automated scanning activity. With the proliferation of AI-driven tools, cybersecurity firms, independent researchers, and malicious actors alike are leveraging AI to conduct massive audits and identify attack vectors at unprecedented speeds. This situation is not unique to CWP; it affects the entire industry.
In light of this new landscape, we want to reassure you about our ongoing efforts:
Rapid response and mitigation: We analyze every report we receive—whether from security firms or the community—and deploy patches as quickly as possible.
Continuous core development: The CWP development team works daily to reinforce the code and adapt our defenses to neutralize these modern, AI-powered automated scanning methods.
Gratitude to the community: Your role is vital. We want to thank all the users and administrators who remain vigilant and actively collaborate with us.
We remind you of the importance of keeping your servers and services updated to the latest available version. If you detect any anomalous behavior, bugs, or potential security flaws, please notify us immediately through official channels so we can assess the issue with the highest priority.
Thank you for your continued support and trust as we work to strengthen the platform every day.
26
Information / Re: New security issue? 09.09.2026
« Last post by comokoko on September 10, 2026, 11:34:32 AM »Currently, many of my servers running AlmaLinux 9 and the latest version of CWP have been hacked using this method.
The attackers are gaining full root access; they are redirecting sites on the server to gambling sites, performing their own Google account verifications, and installing and running crypto-mining services in the background.
I hope CWP is aware of this issue; servers with up-to-date operating systems and the latest CWP panels are being compromised again.
We had previously reformatted and reinstalled the servers I am referring to because they had been hacked due to earlier CWP vulnerabilities, yet serious security flaws persist even in the latest version.
NOTE: This vulnerability is not the same one from previous months. It is a vulnerability discovered this month, as the operating systems and CWP versions on the servers are up to date; furthermore, the servers in question were reformatted and reinstalled approximately one week ago.
The attackers are gaining full root access; they are redirecting sites on the server to gambling sites, performing their own Google account verifications, and installing and running crypto-mining services in the background.
I hope CWP is aware of this issue; servers with up-to-date operating systems and the latest CWP panels are being compromised again.
We had previously reformatted and reinstalled the servers I am referring to because they had been hacked due to earlier CWP vulnerabilities, yet serious security flaws persist even in the latest version.
NOTE: This vulnerability is not the same one from previous months. It is a vulnerability discovered this month, as the operating systems and CWP versions on the servers are up to date; furthermore, the servers in question were reformatted and reinstalled approximately one week ago.
27
Information / Re: New security issue? 09.09.2026
« Last post by kadybee on September 10, 2026, 07:30:42 AM »Yes, I've been battling this one for a few days now and looking for their way in.
It appears the test one is an initial probe and then the aby.php appears. That appears to be a shell of sorts.
It then goes about infecting the site with casino redirects - thai or indonesian thing.
And here's a new one: look for google domain verification HTMLs of the same date. They are taking over domains into their own search console accounts. Try finding somewhere/someone at Google to report this .. I haven't got very far in that endeavour!
I did note that a lot of the files were attributed to root. In your /home directory run: find . -user root |grep public
If you want a date as well: find . -user root -printf "%-25p %t\n" |grep public
For the google verification files, run: find . -name google*.html -printf "%-25p %t\n" |grep public
and check for recent dates.
I also noted files inserted into the wp-content/languages directory.
Will report back if I find anything more!
It appears the test one is an initial probe and then the aby.php appears. That appears to be a shell of sorts.
It then goes about infecting the site with casino redirects - thai or indonesian thing.
And here's a new one: look for google domain verification HTMLs of the same date. They are taking over domains into their own search console accounts. Try finding somewhere/someone at Google to report this .. I haven't got very far in that endeavour!
I did note that a lot of the files were attributed to root. In your /home directory run: find . -user root |grep public
If you want a date as well: find . -user root -printf "%-25p %t\n" |grep public
For the google verification files, run: find . -name google*.html -printf "%-25p %t\n" |grep public
and check for recent dates.
I also noted files inserted into the wp-content/languages directory.
Will report back if I find anything more!
28
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by uma on September 09, 2026, 05:04:42 PM »Further, Site loading properly in browser and view source code in browser is also proper.
But server is intercepting all web requests from bots that have "bot," "crawler," or "spider" so search result in search engine like Google
showing some other metadata instead of our websites data.
Refer similar thread at : http://forum.centos-webpanel.com/other/something-is-intercepting-bots-and-loading-a-different-page-for-them/msg54106/
But server is intercepting all web requests from bots that have "bot," "crawler," or "spider" so search result in search engine like Google
showing some other metadata instead of our websites data.
Refer similar thread at : http://forum.centos-webpanel.com/other/something-is-intercepting-bots-and-loading-a-different-page-for-them/msg54106/
29
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by uma on September 09, 2026, 11:58:37 AM »Hello,
Using CWP since long and love it. I agree with @Netino and assume this issue occurred only after CWP upgrade it file manager.
Because issue occurred around after 10th Aug 2026 in my two server having CWPPRO on AlmaLinux 8 with latest Kernel, CSF Firewall, updated Apache, and
have Mod Security installed running the latest CWPPRO OWASP and does not have any WordPress installation but then also both of my server affected.
In one of my server, all files and folders owner become root in public_html folder and in other server, lot many "cwp_login_randomnumber.php" files generated in public_html folder.
Screenshot attached.
I request to CWP that old stable version was perfect, No any demand for better look then why they update it?
I notice that look for CSF firewall page also changed, Old was far better and easy to use/maintain.
User require only functionality, secured updated supported version and fixes - Not themes and better looks.
If any one guide how to check infections and fix the issue greatly appreciated.
Once again I love CWP.
Using CWP since long and love it. I agree with @Netino and assume this issue occurred only after CWP upgrade it file manager.
Because issue occurred around after 10th Aug 2026 in my two server having CWPPRO on AlmaLinux 8 with latest Kernel, CSF Firewall, updated Apache, and
have Mod Security installed running the latest CWPPRO OWASP and does not have any WordPress installation but then also both of my server affected.
In one of my server, all files and folders owner become root in public_html folder and in other server, lot many "cwp_login_randomnumber.php" files generated in public_html folder.
Screenshot attached.
I request to CWP that old stable version was perfect, No any demand for better look then why they update it?
I notice that look for CSF firewall page also changed, Old was far better and easy to use/maintain.
User require only functionality, secured updated supported version and fixes - Not themes and better looks.
If any one guide how to check infections and fix the issue greatly appreciated.
Once again I love CWP.
30
Information / New security issue? 09.09.2026
« Last post by comokoko on September 09, 2026, 10:33:50 AM »hello
Today, I noticed a file named "test123zz" in the `public_html` directories of user accounts across many of my CWP servers; the owner of these files appears to be root.
I also observe that malicious files named "aby.php" and "vio.php" (And many .html files) were uploaded to the `public_html` directories at the same time as this file.
Seeing this same situation across multiple servers running the CWP panel led me to suspect that the issue might be related to CWP itself. However, if I open a support ticket, CWP asks for payment upfront.
Could you please check the `public_html` directories of the user accounts on your servers and confirm whether these files have been injected into your systems as well?
Today, I noticed a file named "test123zz" in the `public_html` directories of user accounts across many of my CWP servers; the owner of these files appears to be root.
I also observe that malicious files named "aby.php" and "vio.php" (And many .html files) were uploaded to the `public_html` directories at the same time as this file.
Seeing this same situation across multiple servers running the CWP panel led me to suspect that the issue might be related to CWP itself. However, if I open a support ticket, CWP asks for payment upfront.
Could you please check the `public_html` directories of the user accounts on your servers and confirm whether these files have been injected into your systems as well?
