Recent Posts
31
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by audept on August 27, 2026, 01:03:52 PM »In response to overseer ... Big Thanks for the advice!..:..
Trying to add to the forum here as well.
Added the following conf file into the log rotation tool
/usr/local/cwpsrv/logs/*_log {
daily
missingok
notifempty
rotate 14
compress
delaycompress
copytruncate
}
This is tested and working. Use/edit it at your own risk
Notice the copytruncate at the end...learned the hard way that was needed, without it the the cwp process seemed to hold the file and continued writing into the copied file, not a good thing., The log rotation cron then did not create the log file. I am guessing that with a service bounce the original log file would be created.
Hope that this helps someone
Trying to add to the forum here as well.
The access_log was over 3 gbs in size.My advice:
...
Is it safe to delete these two periodically on my own?Code: [Select]truncate -s0 /usr/local/cwpsrv/logs/access_logThen look at File Management > Logrotate Manager and add a rotation job for those files.
truncate -s0 /usr/local/cwpsrv/logs/error_log
Added the following conf file into the log rotation tool
/usr/local/cwpsrv/logs/*_log {
daily
missingok
notifempty
rotate 14
compress
delaycompress
copytruncate
}
This is tested and working. Use/edit it at your own risk
Notice the copytruncate at the end...learned the hard way that was needed, without it the the cwp process seemed to hold the file and continued writing into the copied file, not a good thing., The log rotation cron then did not create the log file. I am guessing that with a service bounce the original log file would be created.Hope that this helps someone
32
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by 6Sense on August 27, 2026, 06:27:58 AM »Hmm what was going down in November? Been many challenges in 2026 I can't remember.
Search says this was current then CVE-2025-48703
Search says this was current then CVE-2025-48703
33
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Netino on August 27, 2026, 04:00:19 AM »There are two vulnerabilities listed in this thread: one for WordPress and another for CWP.
Note that in the case of the file `/usr/local/cwpsrv/htdocs/admin/design/img/ico.php`, the file was made immutable—something that is really only possible with root access.
The file is in one of my servers, and have the following listing:
Note that in the case of the file `/usr/local/cwpsrv/htdocs/admin/design/img/ico.php`, the file was made immutable—something that is really only possible with root access.
The file is in one of my servers, and have the following listing:
Code: [Select]
-rw-r--r-- 1 root root 1477 nov 28 2025 ico.php
# stat ico.php
File: ico.php
Size: 1477 Blocks: 8 IO Block: 4096 regular file
Device: fd01h/64769d Inode: 2892154 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2026-08-25 10:26:44.985182886 -0300
Modify: 2025-11-28 06:17:52.883868313 -0300
Change: 2026-08-24 21:59:57.435060346 -0300
Birth: 2025-11-15 08:06:12.856741480 -0300
34
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Starburst on August 26, 2026, 05:53:18 PM »CWP shows it has Apache 2.4.68 in AL8 and AL9.
2.4.62 is the latest for CentOS 7.
These can be manually updated, which is what we do.
It's like 5 lines of commands.
Not sure if some of the libraries are still there though. EL7 support has been ended for allot of packages.
We also have Apache enabled for HTTP/2, which the stock one doesn't have an option for.
But again, curious why you are running a way past EOL CentOS 7 OS that has major security holes in it?
I know it's a pain to upgrade, we all have been there.
But again, running an EOL OS, you can expect security breaches.
If you need a CWPpro license temporarily to upgrade to AL8 or AL9 (I would recommend AL9), let me know.
2.4.62 is the latest for CentOS 7.
These can be manually updated, which is what we do.
It's like 5 lines of commands.
Not sure if some of the libraries are still there though. EL7 support has been ended for allot of packages.
We also have Apache enabled for HTTP/2, which the stock one doesn't have an option for.
But again, curious why you are running a way past EOL CentOS 7 OS that has major security holes in it?
I know it's a pain to upgrade, we all have been there.
But again, running an EOL OS, you can expect security breaches.
If you need a CWPpro license temporarily to upgrade to AL8 or AL9 (I would recommend AL9), let me know.
35
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by kandalf on August 26, 2026, 03:33:07 PM »CWP team must update the base Apache and NGINX for everyone, this is urgent.
36
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by Starburst on August 26, 2026, 12:49:23 PM »@murad99
Is there a reason you are still running CentOS 7, a past EOL OS?
That alone is a massive security hole.
The past several weeks they have been Kernel updates almost every other day, at least for AL9 and AL10.
But to close some of the security holes, I would updated your:
Base PHP to at least 8.3.33 and the PHP-FPM for the websites. (I'm glad CWP finally got PHP updated)
Apache is at 2.4.68
Nginx is at 1.30.4
jQuery has several notable past Common Vulnerabilities and Exposures (CVEs) related to Cross-Site Scripting (XSS) and DOM manipulation.
(There are 137 entries just for jQuery)
That's not counting the CVE's for CentOS 7, Apache <2.4.68, Nginx <1.30 and PHP <8.3.33
Our AlmaLinux 9 servers are all OK.
But we try to keep everything updated on the server side, unfortunately that doesn't work with some users. :/
Is there a reason you are still running CentOS 7, a past EOL OS?
That alone is a massive security hole.
The past several weeks they have been Kernel updates almost every other day, at least for AL9 and AL10.
But to close some of the security holes, I would updated your:
Base PHP to at least 8.3.33 and the PHP-FPM for the websites. (I'm glad CWP finally got PHP updated)
Apache is at 2.4.68
Nginx is at 1.30.4
jQuery has several notable past Common Vulnerabilities and Exposures (CVEs) related to Cross-Site Scripting (XSS) and DOM manipulation.
(There are 137 entries just for jQuery)
That's not counting the CVE's for CentOS 7, Apache <2.4.68, Nginx <1.30 and PHP <8.3.33
Our AlmaLinux 9 servers are all OK.
But we try to keep everything updated on the server side, unfortunately that doesn't work with some users. :/
37
Updates / Re: Cannot Install PHP-FPM on Alma 8 & 9
« Last post by Jack_C on August 26, 2026, 11:35:28 AM »PHP-FPM works fine on our AL9 ( AlmaLinux 9.8 ) and CWP 1.7 directly from the GUI.
Ok mate, but there are people still using AlmaLinux 8.10 and have an error message when trying to install PHP-FPM 8.4 or PHP 8.5.
I have tried all the available solutions but none of them work for me. Do you have any idea how we who use AlmaLinux 8.10 can fix it?
Thanks
Image attached
38
PHP / Re: PHP-FPM Won't install zlib says missing dependency zlib-dir
« Last post by kandalf on August 26, 2026, 08:29:58 AM »Any solution for this?
I cant even save the /usr/local/cwpsrv/htdocs/resources/conf/el8/php-fpm_selector/8.4.ini in advance editor because I get "Error
Unknown error occurred."
I change it via ftp but inside the panel don't work.
CWP team are using AI and are working in a better pace in the last weeks but they need to add tests to the system to stop breaking things. AI is amazing but we need to know how to work with it
I cant even save the /usr/local/cwpsrv/htdocs/resources/conf/el8/php-fpm_selector/8.4.ini in advance editor because I get "Error
Unknown error occurred."
I change it via ftp but inside the panel don't work.
CWP team are using AI and are working in a better pace in the last weeks but they need to add tests to the system to stop breaking things. AI is amazing but we need to know how to work with it
39
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by overseer on August 26, 2026, 03:33:35 AM »The access_log was over 3 gbs in size.My advice:
...
Is it safe to delete these two periodically on my own?
Code: [Select]
truncate -s0 /usr/local/cwpsrv/logs/access_log
truncate -s0 /usr/local/cwpsrv/logs/error_logThen look at File Management > Logrotate Manager and add a rotation job for those files.40
PHP / Re: PHP-FPM Won't install zlib says missing dependency zlib-dir
« Last post by kadybee on August 26, 2026, 02:15:38 AM »NO. If I go to PHP-FPM selector and try to edit what it installs it throws the zlib-dir dependency error even if I change nothing and LEAVE (it's already selected) zlib enabled and just hit "Save Options." There has been no fix pushed by CWP. So I can't build PHP-FPM 8.4 as I need other custom options enabled.
In the PHP-FPM Selector, select MANAGE OPTIONS of the version you are wanting to install and de-select the zlib option - then select any others you may want - and Save.
EDIT: spoke too soon as PHP-FPM 8.5 installed after the above yet won't start due to "Unable to start pcre module" Will need to investigate the reinstall etc of that module to ensure it doesn't effect the earlier running version.
