Changelog

Admin Panel

CWP 1.30.1 is a security and stability update of the LTS version. Updating is recommended for every server. The panel look and features are the same as in 1.30.

1. Security

Stricter checks of every value before it is used (names, domains, IPs, paths, numbers), escaping of everything shown in the panels, actions on an account’s files done as that account instead of the system, and security tokens on action links. Hardened in particular:

• API v1 (port 2304): every call needs an API key (switch: /usr/local/cwp/.conf/api_strict_guard_off); internal migration routes accept calls only from the server itself; strict checks of all fixed-format parameters; reseller API keys work only on the reseller’s own accounts; passwords are set without a shell and are no longer logged.
• User panel login links (password login, admin “log in as user”, reseller login, API autologin): every link carries a random one-time code and expires.
• User panel internal API: sign-in codes, account details and account management only for the account’s own panel and the system; unused WebDisk and e-mail import calls removed.
• User panel: MySQL, Email Filters, Email Importer, Email Routing, Webmail auto-login, Autoresponders, DNS Zone Editor, Subdomains, PHP settings, Disk Usage, Backups, Notifications, SSL / SSL Wizard, AutoSSL, Tomcat, Git Manager, Streaming (ServerCast/AutoDJ), Varnish cache, ModSecurity editor, Statistics, Antivirus, Log Viewer, Cron Jobs, Addons installer, Fix Account Issues, sign-out.
• User panel two-factor login: the QR code is drawn in the browser (nothing is sent to an outside service).
• Reseller panel: actions work only on the reseller’s own accounts and packages; values are escaped.
• Admin panel: List Accounts / Edit / New Account, Packages, Mail Explorer, Mail Queue, Autoresponders, Cron Jobs, Crontab for root, Logged-in users, Log Viewer, File Manager, Disk Usage, File Editor, Restore Backups, Backup Manager, DNS functions and zone list, SSL Generator / SSL Certificates, IP Manager, IP NAT, Firewall, Process List, Shell Access, System Statistics, Email Statistics, Services Monitor, Date & Time, Yum Manager, Cgroups, Security Center, PHP Selector / PHP-FPM Selector / PHP Switcher, Apache builder, Tomcat, Shoutcast / Icecast, Features / Themes / Languages, DNS Cluster, CWP Messenger, SiteProBuilder, PHP PECL, Monit, DKIM, Maldet, RBL check, Bandwidth monitor, WebServers config editor, Simple Apache editor, dashboard notifications.
• Migrations and restores (CWP->CWP, cPanel->CWP, account transfer, cPanel account restore, cluster sync): values, file names, certificates and DNS zones from the source are checked and written by the panel itself; passwords and API keys are no longer logged.
• Panel output (process lists, logs, journal, installer output) is always shown as text.
• Passwords with special characters are set exactly as typed everywhere (accounts, root, MySQL, PostgreSQL, MongoDB, mailboxes, FTP, migrations, API).
• CWP update: update check and update are downloaded only over verified https.
• Downloads used by the panel (mod_rpaf, ModSecurity, Shoutcast, Icecast) come from the CWP CDN with a fixed checksum; installers from other vendors (acme.sh, Softaculous, SitePad, LiteSpeed, Maldet) over verified https; the cluster API “dev” update option is removed.
• Mail server: the default trusted networks are limited to the server itself (127.0.0.0/8). Existing servers change only if they still use the exact old default (10.0.0.0/8, 127.0.0.0/8, 192.168.0.0/16). Applications on other machines of your private network must log in (SMTP authentication) to send mail.

2. Fixes

• The CWP cron no longer restarts Apache every 4 hours (502 errors behind nginx) or the panel web service without a reason.
• CWP update: servers on the old panel PHP 7.2 can update again; minimal EL9/EL10 installs get the “service” command; ionCube loaders are replaced only after a complete download; the PHP 8.3 migration script no longer unpacks old panel code over a newer one.
• Mail Policyd (cbpolicyd) on EL9: installs its Perl modules (Postfix answered “451 Server configuration problem” for every message), and Postfix uses policyd only when it really runs.
• New Backup: S3 secret keys and FTP / Samba passwords of letters and digits work for scheduled full and incremental backups and restores.
• PHP Defender (Snuffleupagus) installs on PHP 8.x, and failed versions are shown with the reason.
• MariaDB 11.x: user panel backups make clean dumps; the right MariaDB version is shown.
• Admin List Accounts no longer fails (HTTP 500) when the panel settings cannot be read or the list is loaded without filters; editing a reseller’s account keeps its reseller.
• ModSecurity: the installer enables it only when the module was built and Apache accepts the configuration; EL10 gets ModSecurity 2.9.8 (PCRE2).
• MongoDB Manager works with mongosh (EL8 and newer); PostgreSQL and MySQL Manager accept passwords with any characters.
• Node.js Manager works when the panel’s Node.js 14.15.3 is missing.
• Shoutcast installs on EL9 and EL10.
• cPanel migration: the free-space check checks the chosen backup file.
• ClamAV virus definitions are updated automatically; memcached builds against the system libmemcached; Monit templates for PHP-FPM 8.3 – 8.5.
• Admin Policyd page: the page script no longer stops with an error after the table is drawn.
• User panel Streaming: uploading songs to a playlist works (the upload library was not loaded on that page).

Admin Panel

1. New: CWP Secure Kernel and update channels

• CWP update channels (Settings > CWP Settings > CWP updates): LTS (default for every server – tested versions with bug and security fixes) and Edge (newest features first). An Edge version that proves stable becomes the next LTS. Edge builds are published separately; until then every server stays on LTS.
• Security > CWP Secure Kernel rebuilt: health check (rules groups, services, SSH, web), one-click safe mode, apply/update/roll back with an automatic health check (falls back to safe mode when a check fails), per-service Protect / Log only / Off that is kept across rules updates, denials read on demand or captured for a chosen time (no log daemon running all the time), “Allow” for a denial, running processes with their protection, the rules of each service with search, automatic rules updates switch and a support bundle.
• CWP Secure Kernel updates: the panel shows the running and the boot kernel and installs new Secure Kernel versions (nightly or with one click, without a restart). A new kernel is started once, at once or at a chosen time; 3 minutes after the boot it is checked (rules, services, SSH, web) and only then kept as the boot kernel – otherwise the server restarts on the previous kernel by itself. Optional automatic restart at a chosen hour.
• CWP Secure Kernel: when a system kernel update makes a kernel without protection the boot kernel, the nightly CWP job sets the running Secure Kernel back as the boot kernel and shows a notification.

2. Security

• CWP Secure Kernel rules updates run outside the caller’s protection domain (a short-lived system service). On older Secure Kernels a rules update started by the CWP cron job could lose its own rights while the rules were reloaded and leave them half loaded (SSH and websites stopped). Rules version 65 contains the same fix for servers that are not updated yet.
• Secure Kernel rules update: the rules archive is downloaded per version (a CDN node could serve an older cached archive together with the new version number) and is only installed when its version matches; otherwise the current rules are kept.
• Features, Themes, Languages > Feature manager: rule names, modules and accounts are escaped before they are stored.

3. Fixes

• Apache did not start after an update when httpd.conf had mod_auth_form enabled without mod_session (CWP does not use it; it is often enabled by malware). The CWP update now disables that line, starts Apache and shows a notification; the Security Audit warns about an enabled mod_auth_form.
• User panel: changing the language did nothing on accounts whose ~/.conf/cwp.ini belonged to root (older accounts, restores, migrations) – the panel saves it as the account. The nightly CWP job gives the file back to the account.
• User panel: the Cloudflare entry in the menu and on the dashboard opened “Error, module does not exist” (there is no Cloudflare module); removed.
• Varnish (Nginx + Varnish + Apache): sites that force https (“RewriteCond %{HTTPS} off” in .htaccess, WordPress, Joomla…) ended in an endless redirect, and http visitors could get the https page – Varnish cached pages by host and URL only, so the redirect of the http request was also served to https. http and https are now cached separately; existing servers get it from the nightly CWP job (the Varnish cache is emptied once).
• Installer: “–mariadb 11.4” stopped with “Installation FAILED: MariaDB” (MariaDB 11 has the mysql, mysqldump and mysqladmin commands in separate -compat packages, which were not installed). Servers that were upgraded to MariaDB 11 by hand get those packages from the nightly CWP job, so CWP’s account, database and backup tasks find them.
• EL10: panel jobs and scripts no longer print “chown: warning: ‘.’ should be ‘:'” (owner:group syntax everywhere).
• PHP-FPM Selector 8.5: the CWP OPcache settings (memory, revalidate frequency, CLI) were never applied – PHP 8.5 has OPcache built in and the setup step stopped with “Missing extension file opcache.so”.
• EL10: PHP 7.4 and 8.0 (PHP Selector, PHP-FPM Selector, PHP Switcher) failed to compile with the EL10 compiler (GCC 14).
• Feature manager: a changed feature list now applies to the user panel right away (it was cached for up to 5 minutes), and it also applies to accounts created by older CWP versions or imports, which were taken for reseller accounts and ignored the admin feature list until the account was saved again in List Accounts.
• User panel dashboard: remaining addon domains / subdomains are no longer negative for unlimited (-1) packages, and the subdomain count is calculated from the subdomain limit (it used the addon domain limit).

Admin Panel

1. New: EL10 support

• EL10 support (AlmaLinux, Rocky Linux, RHEL and other EL10 systems): installer, panel and packages (panel web server, panel PHP, Apache, PHP Switcher/Selector build scripts). The panel now detects the EL version the same way on every EL distribution. Install with the same command as on EL7-EL9: curl -Lo cwp-latest http://centos-webpanel.com/cwp-latest && sh cwp-latest.
• EL10: user panel login works. EL10 stores passwords as yescrypt, which the user panel login could not check; the login now checks any password hash format of the system, and new passwords are stored as SHA-512 (installer and nightly job), as on EL7-EL9.
• EL10: CSF firewall works (its kernel modules are in kernel-modules-extra, which EL10 does not install by default). The installer installs it and existing servers get it from the nightly CWP job.
• EL10 mail: Postfix on EL10 supports only lmdb maps (no hash); the CWP Postfix configuration is switched automatically (installer and nightly job), and the panel writes its mail maps (SNI certificates, sender white/black lists) in the map type of the server. Mail server manager: AntiSpam/AntiVirus and DKIM & SPF install on EL10.
• EL10: background jobs started with screen (FFmpeg installer, Apache builder, PHP Selector, FTP backup) run – screen refused to start there (“Directory /run/screen must have mode 777”).
• EL10: FFmpeg installer builds current FFmpeg 7.1 (with x264, fdk-aac, LAME, VPx, Opus, AV1…); the old FFmpeg 2.8 / libfaac build does not compile on EL10.
• EL10: Varnish installs for the Nginx + Varnish setups and no longer takes port 8443 (the EL10 package listens there for a TLS proxy – that is the Apache SSL port); Varnish settings are kept in a systemd drop-in that package updates do not overwrite.
• EL10 install/build scripts on the CWP CDN (mail, service and PHP build scripts, PostgreSQL), based on the EL9 ones with the EL10 packages.

2. Security

• ModSecurity “OWASP latest” rules did not block anything: the rule package ships its initialization file only as an example, so the anomaly scores were never added up and attacks were only logged. New installs of these rules block by default; on servers that already use them, the ModSecurity page shows a notice with a button to turn blocking on (the Apache configuration is tested first). Check your sites for false positives after enabling it.
• User panel internal API: hardened the subdomain, addon domain, FTP account, URL redirect, protected directory, reseller and streaming (ServerCast) actions. Values from the request are now validated and never reach a shell; files inside the account’s home directory (.htaccess, .htpasswd, redirect and reseller settings, playlists) are read and written with the account’s own permissions. Reseller actions now require a reseller account and only work on the reseller’s own accounts and domains. FTP passwords are no longer logged or returned in responses.
• User panel internal API: several actions (package usage, statistics, SpamExperts, mail pipes, backup start and database restore) now require a valid session; user login and language lookups validate all values and handle files in the home directory with the account’s own permissions.
• User panel two-factor authentication: the login page now asks the internal API to verify the code; the 2FA secret is no longer handed out.
• User panel backups: backups are now built in a protected staging directory and the finished archive is written to ~/backupcwp with the account’s permissions. Database restores run with a restore account that can only access the account’s own databases, and only CWP’s own database user/privilege lines are taken from the backup. Automatic backups validate the stored file names. Backups no longer include databases of other accounts whose name starts with the same letters. Unused legacy restore actions were removed.
• User panel: the internal helper that runs system commands for panel modules now runs them with the account’s own permissions and only on the account’s own files; the few operations that need administrator rights (DNS zones, SSL certificates, PHP selector, MySQL process list, cron) only work on the account’s own domains. Add-on installers download, unpack and run Drush with the account’s permissions.
• User panel MySQL manager: databases, users and privileges are only changed for the account’s own databases and users (some checks also matched other accounts with a similar name).
• Web server configuration: per-domain settings stored in the account’s home directory are validated before they are used to build Apache/Nginx/Varnish configuration.
• PHP version selector (.htaccess) and web server settings are written with the account’s permissions.
• User panel e-mail accounts and forwarders: quota, status, password and delete actions only work on addresses of the account’s own domains.
• User panel SSL (Let’s Encrypt): install, renew, delete and force-renew only work on the account’s own domains.
• User panel File System Lock: refuses to lock when public_html is not a real directory.
• User panel WordPress Manager: file, archive, database and WP-CLI operations run with the account’s permissions; database export/import/query use the site’s own database login and only the account’s databases.
• User panel add-on installers (Laravel, Magento, Nextcloud, phpBB, Moodle, WHMCS, …) run with the account’s permissions.
• User panel MongoDB and PostgreSQL managers: database and user names, roles and passwords are validated (passwords may not contain quotes, $, ` or backslash).
• User panel Node.js and Tomcat managers: application domains and paths must belong to the account; web server settings are written with the account’s permissions.
• User panel: notification settings, cron copy, caches and dashboard settings in the home directory are read and written with the account’s permissions; the asset compressor only reads panel scripts. A legacy internal action that ran arbitrary commands was removed.
• External API (port 2304): the account backup/migration actions are only allowed for API keys with the backup permission, “all”, or the “CWP to CWP” preset; other keys (e.g. a billing key) can no longer use them.
• Webmail ports (2095/2096) and /roundcube on the panel ports: Roundcube’s log files, configuration and installation files (logs/, config/, SQL/, vendor/, .htaccess, composer files, …) can no longer be downloaded (the existing block never matched on the webmail ports).
• Panel web server (cwpsrv): TLS 1.0 and 1.1 are no longer offered on the panel, user panel, webmail and internal API ports (TLS 1.2, plus TLS 1.3 where the system OpenSSL supports it). The external API port (2304) installer no longer enables TLS 1.0/1.1 either.

3. Mail

• Incoming SPF check: “Install DKIM & SPF” now really checks SPF for incoming mail (the policy service was installed but never used): mail whose sender domain fails SPF hard (“-all”) is rejected, soft failures only get a Received-SPF header; local and authenticated senders are not checked. New installations have it on.
• DKIM keys of new domains are 2048-bit (were 1024); the DNS record is written as several strings so the long key is published completely. Existing keys stay until DKIM is removed and enabled again for the domain.
• SRS for forwarded mail (postsrsd): forwarders and aliases to other providers keep working where the sender’s SPF is checked (Gmail, Outlook…). Mail of the server’s own domains is not rewritten. New option in Mail server manager (on by default), on for new installations.
• With AntiSpam/AntiVirus enabled, mail sent over port 25 went out with two DKIM signatures (it passed the DKIM signer again after the spam check). Fixed on existing servers by the nightly update and on every mail server rebuild.
• Mail on EL8 and EL9: the nightly check that installs the missing postfix-mysql package (without it no mail is accepted) did not run from cron; it runs now.
• Mail server rebuild: MySQL map files are no longer left group/world-writable.
• Policyd: the installer adds the policy check to Postfix also when smtpd_recipient_restrictions continues on the next lines of main.cf (EL9) – before, Policyd was installed but Postfix never used it; uninstall removes it the same way. The Policyd page shows “Policyd not installed” instead of a blank page.
• Roundcube: /scripts/mail_roundcube_update checks the sha256 of the CWP webmail plugin files it downloads and says clearly when Roundcube cannot be updated because the panel PHP is still 7.2; the admin panel also shows a notification (at most once a month) when Roundcube stays on the end-of-life 1.5 for that reason.

4. CWP to CWP migration

• New step “After the migration: move the old server’s IP to this server”. Once the old server’s IP is configured on the new server, it replaces the temporary IP in the shared IP, all accounts, all DNS zones (A records, SPF; new serial, copies of the old zones are kept) and rebuilds the Apache/Nginx/Varnish vhosts in the background, with a log; files outside CWP that still mention the old IP are listed.
• From EL8 source servers the migration no longer stops at 20% with “The backup on the source server stopped without finishing”; migrations from a source running CWP 1.28 no longer stay at 0%.
• Accounts with accented webmail (Roundcube) contacts are migrated with all their mailboxes, aliases and autoresponders again; Roundcube contacts and identities show up in webmail after the migration.
• Copied SSL certificates are registered on the new server, so the migrated domains are served over HTTPS right away.
• Addon domains and subdomains of migrated accounts no longer answer “403 Forbidden”.
• Accounts without databases no longer finish with a false “Database import failed” error.
• Databases from a newer MariaDB/MySQL source (MariaDB 11 “uca1400” or MySQL 8 “0900” collations) are imported on a server with an older MariaDB; a database whose charset/collation is still not supported is skipped with a clear message instead of failing half way.
• “Sync again” with databases: a database is replaced only after the new copy was fetched and checked.
• A package with the same name that no account uses yet (e.g. “default” on a fresh server) takes the limits of the source package; if local accounts already use it, its limits are kept and the migration log says what differs.
• A domain set to a PHP-FPM version that is not installed on the new server no longer ends up with a disabled vhost: it switches to an installed version (the migration log says which).
• MySQL users of an account that have no database privileges yet are migrated too, with their password.
• The migration page warns when this server has no CWPpro licence yet (without it the PHP-FPM sites of migrated accounts stop working on this server).

5. Web servers

• Apache (cwp-httpd) updated to 2.4.69 on EL7, EL8 and EL9 (new package for EL10). Apache configuration files are no longer replaced by package updates; works unchanged with Apache only, Nginx + Apache and Nginx + Varnish + Apache.
• Apache (cwp-httpd 2.4.69-2, EL8 and EL10): the 2.4.69-1 package had a broken apxs tool, so Apache modules could not be built and putting Nginx in front of Apache could leave Apache stopped. Fixed package; existing servers get apxs repaired by the nightly CWP job, and the web server setup uses Apache’s own mod_remoteip for the real visitor IP whenever mod_rpaf cannot be built.
• Apache: restarting Apache could keep all websites down (502) for up to 90 seconds while a single slow request was still running. A restart now waits at most 10 seconds for running requests.
• Apache builder: offers current Apache versions up to 2.4.69.
• Nginx: updated to 1.30.6 also on EL7 (the nginx.org packages for EL7 stopped at 1.26.1; CWP now provides the package for EL7 in its repository, built from the official nginx.org sources).
• Nginx updates no longer bring back the “Welcome to nginx” default site, keep the open files limit (65535), and on servers with CWP Secure Kernel no longer leave nginx without its PID file. The configuration check no longer reports a false “Too many open files” error on servers with several hundred domains.
• Nginx: TLS 1.3 is enabled for all domains (vhosts get it when they are rebuilt). Images are no longer gzip-compressed again. The Cloudflare address list is updated and includes IPv6.
• Nginx: disabling a still active “Welcome to nginx” default site now restarts nginx (a reload could not move nginx to the server IPs, so new domains were not served until the next restart).
• Varnish: when /etc/varnish/default.vcl is still the stock file of the varnish package, it is replaced with the CWP one as soon as a domain is rebuilt; before, every request through Varnish answered 503.
• Web servers: a domain or subdomain whose path is not valid is skipped when the vhosts are rebuilt instead of breaking the Apache/Nginx configuration of the whole server (logged in /var/log/cwp/webservers_rebuild.log).
• Web server and PHP-FPM templates: a custom template containing % signs of its own (e.g. php-fpm access.format, Apache LogFormat) was treated as “template failed”, the configuration was saved as .disabled and the site returned 502.
• Panel web server (cwpsrv) updated to nginx 1.30.6 (from 1.24.0 on EL8/EL9 and 1.15.10 on EL7). Existing panel configuration is kept.

6. PHP

• PHP Selector, PHP-FPM Selector and PHP Switcher: end-of-life PHP versions that CWP builds with its security backport (5.4.45 – 8.1.34) are marked “CWP security patch” in the version list; an installed patched version is shown as the current version again.
• After a rebuild or a switch to another PHP version, the ionCube and SourceGuardian lines could still name the loader of the previous version, so PHP printed only the loader error and the user panel PHP Selector failed when saving. The loader lines and a stale extension_dir are now corrected after every build and nightly.
• PHP (EL8/EL9): PHP versions built with CWP’s private OpenSSL could not verify any TLS certificate (HTTPS requests, SMTP with STARTTLS, payment/mail APIs failed). The nightly CWP job now points it at the system CA bundle.
• PHP 8.3-8.5 on EL8/EL9: mbstring was silently missing when the PowerTools / CRB repository was not enabled; the build now installs it from there and reports it clearly when it cannot.
• Options such as zlib could not be enabled for a version built before (the page reported a missing dependency).
• PHP Switcher: saving the build options no longer hangs when a CWP CDN node does not answer.
• Packages: saving a package on a server without cgroups stored “undefined” as the cgroups policy, which broke the user panel PHP Selector for its accounts. Fixed, and existing packages are cleaned up automatically.
• CWP update: “Unable to start pcre module” is repaired also when a second, newer pcre2 library without JIT was installed in /usr/local/lib by a PHP build.

7. Panel

• New CWP Update page (Dashboard “CWP update available” and the Maintenance “Update” tile opened “The module update does not exist”): installed and latest version, “Update CWP now” and its log.
• CWP update (/scripts/update_cwp) run by hand from a terminal no longer prints “pkttyagent … Unable to register authentication agent” warnings after every service restart/reload.
• Terminal (admin panel): rebuilt on a current terminal component. UTF-8 input and output work, keys typed with AltGr (e.g. | @ { } on European keyboards) work, pasted text is kept as it is. New toolbar: shell, reconnect, font size. The terminal no longer stops working after the first night and no longer closes terminals open in other tabs.
• GoAccess statistics: the monthly report was never created – on the 1st of the month GoAccess did not run at all, so the daily report for the last day of the month and the monthly cleanup were skipped too.
• Cgroups Resource Limits now work on EL9 (cgroup v2): the new cwp-cgroups2 service applies the CPU, memory and disk limits of the policies as systemd slices per account.
• Server Date & Time: changing the timezone also sets it for the panel’s own PHP; the form shows the server’s local time and the clock is only set when date or time were changed; “Restore or keep server timezone” no longer deletes /etc/localtime; UTC can be selected.
• Node.js Manager: “NPM install” and npm console commands of an account’s application work again; a stopped install (process limit) shows why instead of “running” forever. User panel Node.js / Tomcat: an install that could not start is no longer shown as running forever.
• User panel File Manager: “Compress” works when the archive is saved in another folder; .tar.gz archives are compressed.
• User panel DNS Zone Editor: records for the domain itself (“@”, e.g. SPF/DMARC/verification TXT, CAA) can be added and edited again, and CAA values with “;” are accepted.
• User panel backups: backups uploaded to FTP are sent in binary mode. Protected directories with spaces or special characters in the name work.
• List Accounts “Export to Csv”: accented characters are no longer garbled in Excel.
• CSF firewall: “Check for updates” no longer fails with “Unable to download: No Host option provided” (ConfigServer closed its download servers; CSF is updated together with CWP); the daily CSF auto-update check is switched off.
• phpMyAdmin update no longer stays silently on the old version when the phpMyAdmin folder is locked.
• Security Audit: libraries in /usr/local/lib64 (libzip from the PHP builds) are no longer reported as unknown files.
• Logs: Apache’s own logs (incl. modsec_audit.log) and the panel PHP log are rotated (weekly or at 100 MB); scanners probing missing files on the panel ports no longer fill the panel error log; the nightly log fix no longer restarts the panel every night; installer downloads no longer write progress lines into the panel PHP log; fewer PHP warnings.
• Admin panel menu: all menu groups use the same icon set.

Admin Panel

1. Security

• PHP Defender (Snuffleupagus): PHP versions running as CGI (suPHP) or from the shell no longer stop with “Could not startup” when PHP Defender is enabled for them – the rules PHP reads were in a folder only root can open. They are now published to /usr/local/cwp/phpdefender/ (the editable copies stay where they were); existing installations are switched automatically by the daily cron.
• PHP Defender: a version whose Snuffleupagus extension is missing or was built for another PHP version (so the rules were silently not applied) is marked “Not active” in Security Center > PHP Defender; delete and install it again.

2. Fixes

• Dashboard: no more “AutoSSL is disabled” warning that pointed to a missing page (“The module autossl does not exist”) – the warning now only appears when SSL auto-renewal is off, and the AutoSSL tile and warning open SSL Certificates.
• SSL Certificates > Configure: saving no longer ends with a PHP 8 error; the cron times are validated.
• PHP Switcher 8.4 / 8.5 on EL7: the optional modules (imagick, sodium, redis, memcached, apcu…) install again; they looked for php-config in a folder the Switcher PHP does not use and stopped with “configure failed”.
• Webmail (Roundcube 1.6): logging in through https://your-domain/webmail/ works again – the login form sent the login to the website instead of webmail. Existing servers are fixed automatically by the nightly Roundcube check.
• Webmail auto-login from the admin panel (Email Accounts) and the user panel works again with Roundcube 1.6 (it ended on the login page).

Admin Panel

1. Security

• Admin panel: a large security review of all admin modules. Fixed many command-injection, SQL-injection, path-traversal and XSS issues and added missing CSRF protection (DNS, e-mail, firewall, cron, backups, file editor, PHP settings, web servers, services, SSL, streaming, system tools and others).
• Dashboard search and FTP Manager (admin panel) validate their input before using it in commands and database queries.
• Removed a remote code-evaluation path from “Webpanel add-ons” (the add-ons page is now static).
• External API (port 2304): authentication added to the transfer/migration endpoints, input validation on all MySQL routes, SQL injection in token validation fixed, session signatures compared strictly (constant-time).
• User panel API (port 2302): MySQL Manager no longer passes user input or passwords through a root shell.
• SSL Certificates (AutoSSL): the user field of the domain list is validated (SQL injection); domains that already have a certificate are labelled “already has SSL” instead of only being greyed out.
• New Backup archives, database dumps and temporary copies are readable by root only (they were readable by every shell user on the server). Existing backup folders are locked down on the next backup run.
• The CWP to CWP migration package on the source server (account databases) is readable by root only.
• WordPress auto-login links (Addons) use random names and expire after 2 minutes; leftover one-click login files from older versions are removed automatically (log: /var/log/cwp/wp_autologin_cleanup.log).
• ModSecurity OWASP CRS 3: the rules now really block (they were detection-only); new installations block by default, existing ones get an “Enable blocking” button. The rules are no longer downloaded again on every update.
• PHP Defender (Snuffleupagus): rules v2 that work on PHP 7 and 8, explicit rules update with backup, a store for custom rules, Snuffleupagus pinned and checksum-verified from the CWP CDN.
• SSH Config Manager: settings now take effect on EL8/EL9 (the CWP drop-in 00-cwp.conf is read first) – before, e.g. “PasswordAuthentication no” could stay enabled; “kill session” is limited to real SSH sessions.
• /scripts/install_supportKey remove no longer empties root’s authorized_keys when the support key is not installed; only the support key line is removed (with a backup).
• CWP Secure Kernel: new rules update script – downloads with timeouts, checks the archive before replacing anything, keeps local files (disabled domains, own USER_DEFINED rules, CUSTOM settings) and installs through the install_rules.sh that comes with the rules; old-format archives are still installed the previous way. The update script remembers the version that was really loaded: before, rules that were unpacked but not loaded (failed check, interrupted run) counted as installed and were never loaded; servers in that state get them on the next run. Rule files locked or changed by the admin are reported instead of being skipped silently. Secure Kernel rules v59: support for newer kernels and libraries (OpenSSL 3, PHP 8.4 ICU libraries), Node.js applications, and cron jobs that need PAM.
• Nightly security cleanup: the cloud admin login (centos, almalinux, rocky, ec2-user…) is no longer locked and its SSH keys are no longer deleted every night; everything the cleanup changes is logged in /var/log/hacker_cleanup.log; the panel web server is restarted only when its configuration really changed. MySQL accounts named like known backdoors (admin, sys, mariadb, dbadmin on any host) are no longer deleted every night: the admin gets one panel notification per account instead.

Security Audit

• Warns about anonymous MySQL accounts and grants that open every database to every user.
• Warns about active API keys usable from any IP and whether port 2304 is open in the firewall.
• Detects trojaned Apache modules that serve different content to search-engine bots (SEO cloaking malware found as a replaced mod_auth_form.so) and reports whether the module is loaded.
• No more “Unauthorized port: php-fpm” (unix sockets were taken for TCP ports).
• No false “Unknown file” alert for /usr/lib64/gconv/gconv-modules.cache; files outside the known paths that belong to an installed package and are unmodified are trusted.
• No “Unowned file” alert for a library name that is neither on disk nor still mapped a moment later (seen during package updates).
• No false “process running from RAM” / “ghost file” alarms after package updates; alerts name the process and PID; deleted executables are detected correctly on all kernels (including OpenVZ).
• Security Advisor (nightly cron): yum/rpm checks have time limits; a stale RPM lock no longer hangs the whole nightly cron for days.

2. PHP Selector / PHP-FPM Selector / PHP Switcher

• PHP Selector, PHP-FPM Selector and PHP Switcher install the newest version of each PHP with the default CWP build options from ready-made CWP packages (cwp-php-cgiNN, cwp-php-fpmNN, cwp-php-switcherNN) in seconds instead of compiling it; your php.ini, php-fpm.conf and extra php.d settings are kept. Versions with custom build options are still compiled from source, and if a package is not available the version is compiled as before. The nightly PHP auto-update uses the packages too.
• PHP 8.3, 8.4 and 8.5 built with the ionCube option now really get the ionCube loader: the build used the PHP 8.2 loader, so ionCube was missing (selectors) or failed to load (switcher). Rebuild the version or install it again to fix an existing server.
• SourceGuardian for PHP 8.3/8.4/8.5 loaded the 8.2 loader (did not work); now the matching loader is used.
• A build no longer starts when the build options of that version cannot be read (e.g. after an incomplete update). Before, it ran with an empty configure line and installed the new PHP over the PHP Switcher version in /usr/local; the panel now shows what is missing. The CDN build scripts check this too.
• Builds started from the panel are no longer interrupted (they run as their own service) and no longer hang on a stalled download (timeouts and retries).
• A failed build is reported as failed (log and notification) instead of “Build Completed”; old php.d ini files of modules that cannot load in the new build are disabled automatically. The result check after a build runs again (it stopped with “No Loader is installed”).
• PHP Switcher: when a build fails, the current PHP keeps its extensions (mbstring, imagick, sodium…); before, their settings were deleted at the start of the build.
• PHP Switcher 8.3/8.4/8.5: the mbstring module is built and enabled again.
• PHP builds use all CPU cores again (the memory check fell back to one job on OpenVZ and older kernels, so builds took 2-4x longer). Small servers get temporary swap during the build to avoid “Killed signal” (out of memory).
• php.ini is no longer overwritten when a version is rebuilt or updated (the new default is saved as php.ini.default).
• PHP auto-update: picks the newest version, failed builds are retried with back-off (not every day), quiet cron mail, per-version log.
• New command line tool /scripts/cwp_php: list installed versions, rebuild one or all versions with the options chosen in the panel (e.g. for CVE patching), toggle auto-update, show or change the PHP version and handler (PHP-FPM / CGI / default) per domain.
• Optional PHP extensions (redis, memcached, memcache, imagick, ssh2, mailparse, sodium, uploadprogress, yaz, apcu, SourceGuardian, xcache, mbstring) download only from the CWP CDN, with versions pinned per PHP branch and compile-tested; no third-party repositories or prebuilt binaries from GitHub any more.
• Xdebug installs on PHP 8.2 – 8.5 (Xdebug 3.5.3) and again on PHP 7.0 / 7.1 (Xdebug 2.9.0).
• PHP 8.1 – 8.5 with AVIF (GD) built on the first try again on EL7, EL8 and EL9 (“libavif >= 0.8.2 not met”).
• PHP 8.4 / 8.5 build options: zlib can be selected again.
• CentOS 7: PHP 8.4 / 8.5 builds no longer stop with “libcurl >= 7.61.0 not met” on servers where the bundled curl could not be linked.
• EL9: PHP build dependencies are installed again, and the IMAP libraries for builds with IMAP too; a dead third-party repository no longer stops the dependency installation on EL7/EL8/EL9.
• EL9: PHP 7.4 builds again (“GD build test failed”).
• EL9: PHP versions broken by the EPEL libavif update are repaired automatically.
• EL8/EL9: the service command is installed automatically before a PHP build when it is missing (minimal installs), so PHP-FPM versions no longer show as failed.
• Removing a PHP-FPM version stops and disables its service cleanly.
• PHP-FPM pools get a safety request_terminate_timeout (stuck workers no longer block a site forever).
• Dashboard / PHP Switcher show “Not installed” when the switcher PHP is missing.

3. Backups

• New Backup restore: restoring an account no longer stops at the Domains step on the PHP 8 panel (addon domains, subdomains and mail accounts were not restored); a selective restore of domains from an SSH backup restores the chosen domains. Restored addon domains and subdomains get the right document root (they answered 404), the backup’s own files are no longer copied into the user’s home, hidden files of the home directory (.bashrc, .ssh…) are restored, and public_html keeps the group the web server needs (restored sites returned 403).
• New Backup / CWP to CWP restore: FTP account passwords are restored again.
• New Backup: FTP, SFTP, SSH, Samba and S3 passwords and keys containing “+” are saved and tested correctly; a “+” or “&” in a server name, user name or path no longer breaks the saved settings or the connection test. Re-enter the password of a remote backup that kept failing with “login failed”.
• Scheduled FTP, S3 and Samba backups no longer fail with “login failed” for passwords or secret keys made only of letters and digits. If you entered the base64 form of your S3 secret as a workaround, enter the real secret again.
• S3: account list and restore work (were empty/missing).
• Samba/NAS: backups go to the configured folder structure (they were written to the share root and overwritten); account list and restore added; archives left in the share root by older versions can be restored.
• NFS: the mount is checked before writing; credentials are no longer written to backup logs.
• SFTP backups use the current stable phpseclib 2.0.55 (security fixes, PHP 8 support); about 35 MB of unused development tools and test files of the old library are removed from the server.
• The backup notification e-mail shows the real destination (S3 / Samba / NFS) instead of “Type: Unknown”.
• User backup script: the archive no longer includes the backups folder itself, the account’s home and databases are matched exactly (similar user names are no longer mixed up), invalid user names are rejected.
• Daily MySQL backup on AlmaLinux 9: no more daily “perl(DBD::mysql) is needed by percona-toolkit” error; the grants file is written even when Percona Toolkit cannot be installed. Same fix for the grants view in MySQL Manager.

4. CWP to CWP migration

• Webmail (Roundcube) data of every mailbox is transferred too: contacts, groups, identities and signatures, canned responses, collected addresses, settings, calendars and task lists. “Sync again” adds what changed on the source in the meantime without creating duplicates. Nothing has to be installed on the source server.
• Reliable on big servers: jobs run as their own systemd units (no longer killed by a panel restart), automatic resume, watchdog, parallel accounts, rsync retries, streamed database import, free-space check.
• Migrates everything: mail, mailboxes, databases (routines/events/triggers, utf8mb4), DKIM keys, FTP accounts (including the default login), per-domain PHP-FPM version and web server settings (adapted to the destination stack), suspended state and passwords of suspended accounts.
• Firewall ports are opened and closed automatically on both servers; per-account verification report (files, mail, mailboxes, tables); “Retry failed” and “Sync again” (copy changes made on the old server before switching DNS).
• Faster: plain tar archive, pigz for dumps, low-priority (nice/ionice) copying, optional bandwidth limit.
• Fixed: restore failing at ~40% on PHP 8.
• API Manager: adding an API key also sets up the API service (port 2304) when it is missing, so a new server can be the source of a migration.

5. Mail

• Roundcube webmail updated to 1.6.20 (LTS; 1.5 is end of life and has known security issues). The update makes a backup of the files and the database, checks the webmail login page afterwards and rolls back automatically on failure; servers whose panel PHP is older than 7.3 keep their version until the panel PHP update. The downloads are checked against SHA-256 checksums before anything is installed.
• Roundcube: the stock encryption key (des_key) is replaced by a random one per server.
• EL8/EL9: mail keeps working when unattended updates replace postfix (postfix-mysql installed automatically).
• EL9: DKIM/SPF installer and mail-server rebuild files added; EL8 DKIM/SPF script fixed.
• Email accounts list: correct usage for unlimited mailboxes; the list loads on PHP 8.
• DNS: option to create new zones without DKIM.
• AntiSpam (Spamhaus DROP list): the block works again and covers the whole list. The module now enables the CSF SPAMDROP blocklist (all networks, refreshed every 24 h); removing it in the module disables the blocklist again. Existing Spamhaus cron jobs (which never ran) are updated automatically.

6. Web servers / system

• AutoSSL: certificates issued with the current Let’s Encrypt chains are recognised again and renewed; before, certificates not created by AutoSSL itself were reported “Renewable: false” and expired.
• Apache no longer goes down when the nightly cron reloads it right after a restart on busy servers.
• WebServers: nginx is installed from the nginx.org repository for the right EL version; when nginx cannot be installed nothing is changed (before, Apache was moved to port 8181 anyway and all sites went down). Broken nginx.repo files from older versions are repaired.
• PHP-FPM pools of deleted accounts no longer stop a whole PHP-FPM version from starting: the daily cron moves such pools aside (kept in /root/cwp-orphan-fpm-pools); account removal through the API removes the pools too.
• Port/vhost rebuild no longer corrupts ports (e.g. :818181).
• suPHP: when the default PHP handler pointed to the panel’s own PHP, the daily cron corrects it.
• phpMyAdmin updated from 5.1.1 to 5.2.3 (security fixes). The panel auto-login uses phpMyAdmin’s single sign-on, so its CSRF protection stays enabled; backup, check and automatic rollback like for Roundcube.
• Panel PHP 8: the zip extension and PostgreSQL support (phpPgAdmin) are built automatically (/scripts/cwpphp_ext).
• Panel PHP 8.3 update: servers left with old panel code on the PHP 8.3 runtime are detected and get the new code.
• Nightly cron / CWP update: no longer stops with a PHP fatal error when a database query fails; stalled downloads time out instead of hanging the update for hours; a broken third-party repository no longer stops the update; Roundcube/intl are no longer reinstalled on every update.
• /scripts/update_cwp repairs a pcre2 library without JIT left by older PHP builds (“Unable to start pcre module”).
• Yum Manager: an unreachable third-party repository no longer leaves the page on “Checking for updates…”.
• CWPpro license check: a slow or unreachable license server no longer switches CWPpro off (and no longer stops PHP-FPM); only a definitive “not licensed” answer counts.
• EL9: CSF/LFD works on servers without iptables (installed automatically).
• Dashboard / Firewall: the firewall is no longer shown as “Off” while CSF/LFD run on minimal EL8/EL9 installs; the LFD Status page works on systemd servers.
• All panel downloads use the CWP CDN (static.cdn-cwp.com).
• cwpsrv logs are rotated and no longer at debug level; no more “sed: can’t read …/api.conf” on new installations.
• GoAccess statistics are generated again on EL8/EL9.
• Account removal deletes the account’s MySQL databases again.

7. Admin panel

• New modern layout (sidebar, top bar) and redesigned modules across all menu groups.
• Dashboard: CPU and Disk IO gauges work on EL8/EL9; CPU, memory and system details are refreshed after a reboot; Disk Details show used and free space.
• Packages: “unlimited” (-1) limits are no longer changed to 0 when a package is saved, and the page explains the values; deleting a package no longer ends with an error on servers without the policyd mail limiter.
• Reseller: auto-login from Reseller > Accounts works.
• Admin console (Terminal): fixed repeated characters, Backspace and paste.
• Code Editor: empty files (e.g. authorized_keys) open and can be saved empty again.
• Theme/language settings: saving no longer leaves an empty config that broke the user panel login.
• Node.js Manager: apps are no longer shown as stopped while running; installing NVM works again after a failed install (same fix in the Tomcat Manager).
• DNS Cluster (Cluster CWP) module loads again on the PHP 8 panel.
• Shoutcast / Icecast: the Config button of an Icecast server shows its settings again. AutoDJ (LiquidSoap): the install stops with a clear message when the LiquidSoap repository is not available (the upstream repository was removed); before, it left a broken repo file that stopped every yum command on EL7.
• Correct timestamps in SSL/DNS/backup file names; repeating the same notification updates it instead of failing.

8. User panel

• Login works for passwords whose encoding contains “+”, for accounts without a ~/.conf folder, and when the disk or quota is full (session fallback, also for existing accounts); the login history is capped.
• PHP Selector: new versions appear right after the build, no hang when a backup copy of a PHP folder is in /opt/alt, no false “You need a CWPPRO license” message.
• Backups can be downloaded directly from the backup list (no copy into public_html any more); large archives download without stalling.
• Addons (WordPress, Joomla, Drupal, PrestaShop): the panel says why an installation cannot start (e.g. the database limit of the package is reached), checked before anything is downloaded. WordPress Manager: broken installations can be deleted, the WP admin link is correct, old one-time login files are cleaned up daily.
• MySQL Manager: passwords with special characters are saved correctly; phpMyAdmin auto-login explains a panel/MySQL password mismatch.
• Reseller > Accounts: the list no longer fails for accounts without bandwidth statistics.
• Password reset: the page and the e-mail follow the user’s language; added Portuguese, Brazilian Portuguese and Croatian.
• New language: Portuguese (Brazil) for the admin and user panel. 30 language files that could not be read were repaired; new texts of this release are translated into all panel languages. The language switch accepts only installed languages.

9. API (port 2304)

• Updating an account (/v1/account with action=udp) works with a key that has the account “Update” permission (it always answered “Unauthorized action”). The reseller preset in API Manager now also ticks this permission.
• API Manager: keys open to every IP are marked in red with a warning; Source IP must be one valid IP address or ALL; new keys come from a cryptographically secure generator; key fields are validated.
• API Manager: translations load again for several languages, and all texts follow the panel language.
• account list, account details and quotalimit return the real disk usage.

Admin Panel

1. Panel PHP 8.3 and PHP builds

• Panel PHP 8.3 update: backup, health check and automatic rollback; the missing libzip dependency on AlmaLinux 8 is installed; the update cannot run twice at the same time.
• PHP Selector / PHP-FPM Selector / PHP Switcher: the bundled pcre2 library is built with JIT (a pcre2 without JIT stopped PHP with “Unable to start pcre module”); servers with such a library are repaired by the panel PHP update.
• CentOS 7: PHP 8.4 and 8.5 for the PHP-FPM Selector and the PHP Switcher (build options were missing), and all optional modules for PHP 8.4/8.5 (13 extensions plus sqlsrv/pdo_sqlsrv) from the CWP CDN.
• AlmaLinux 8/9: mbstring for PHP 8.4 and 8.5.
• MySQL root password reset: works on all MySQL/MariaDB versions and checks the new password before saving it.

2. Admin panel

• List Accounts no longer fails on the PHP 8 panel for packages with unlimited bandwidth.
• External API (port 2304): security fix in the cron job endpoint (user validation, no shell); the user parameter is always checked. Node.js Manager list fixed on PHP 8.

3. User panel

• Many PHP 8 fixes: Email Accounts and Forwarders (unlimited quotas, webmail auto-login), Crontab (“Run now”), Statistics, Protected Directories, ModSecurity, Disk Usage, Backups (download), File System Lock, Streaming, Node.js, Tomcat, MongoDB, Let’s Encrypt, Redirects, Reseller (unlimited bandwidth), notifications cron.
• Security: file and folder actions are confined to the user’s home; command injection fixes in ModSecurity, Disk Usage and Backups; password recovery uses secure random tokens and no longer leaks tokens or SQL errors.
• PHP Selector: only versions that are really installed are offered; clearer layout and fixed option buttons.
• New: MySQL process list, live access/error log in Statistics.
• Email: quota validation, “Never” for mailboxes that were never used, subdomain mailboxes count toward the package limit.
• Translations: missing texts fall back to English per text (labels were empty in incomplete languages); English text corrections.
• Theme and dark mode moved into the “My account” menu.

Admin Panel

FIXED ADMIN UPDATED
– Backup System Improvements
– Enhanced API Security

FIXED USER UPDATED
– Security improvements
– Fix WordPress tool module

User Panel

Admin Panel

FIXED ADMIN UPDATED
– Backup System Improvements
– Adjustments to PHP versions: 8.3 for el7 and 8.4 and 8.5 for el8 and el9
– Enhanced API Security

FIXED USER UPDATED
– Backup System Improvements
– Security improvements
– Spam annihilator module
– WordPress tool module
– Improvements to the DNS editing module

User Panel

Admin Panel

FIXED ADMIN UPDATED
– Improved security for login and session
– Improved security on file system functions
– Improved security for API
– New script for cleaning server logs /scripts/clean_logs
– New script for checking disk quota status /scripts/quota_check_status

User Panel

Admin Panel

FIXED ADMIN UPDATED
– Roundcube
– Ioncube
– Change Root Password
– New Security fix resolving recent vulnerability issues
– Removed WebFTP old version that was not in use.

User Panel

Admin Panel

FIXED ADMIN
– Backup module
– General security settingx
– Change Root Password

User Panel

Admin Panel

FIXED ADMIN
– Backup module
– General security settingx

User Panel

Admin Panel

FIXED ADMIN
– Language adjustments
– Adjustments in the Custom Server module
– Added SMB, NFS, and S3 protocols to the Backup module
– Added Backup MongoDB and PostgreSQL

NEW ADMIN FEATURE
+ Configuration module for Git options in the user interface
+ Postfix List Manager module

User Panel

FIDEX USER
– Two-step authentication (2FA)
– Security fix in the login system
– Password recovery fix

NEW USER
– Module for synchronization with Cloudflare
– Module for deploying from Git
– Added autologin for admin in the WordPress add-ons module

Admin Panel

– Fix File Manager module

– Fix mysql module

– Fix Security

User Panel

– Fix addons module

Admin Panel

– New php version

– Fix migrations module

User Panel

– Fix reseller module

Admin Panel

– No changes.

User Panel

– Fixed minor Reseller side issues.

Admin Panel

– Fix for Mongo Manager module

– Fixed Account Transfer Module

– Fixed Backup Module

User Panel

– Fixed Reseller Panel Statistics

– Fixed Autoresponder Issue

– Fixed For Centos stream 9 login

– Fixed Tomcat Module

– Fixed and Miscellaneous Security Settings

Admin Panel

– CWP maintenance release

– New php versions released

– Installer for El9

User Panel

– Maintenance release for User Account

Admin Panel

– New php versions
– Various fixes to PHP

User Panel

–

Admin Panel

– New php versions

User Panel

–

Admin Panel

– New php versions

User Panel

–

Admin Panel

– Improvements in the account migration process
– New fields were added to the responses of some endpoints of the APIs

User Panel

– Fix 2fA
– Fix in login form language

Admin Panel

– Important fixes in the CWP-CWP migration module.

User Panel

–

Admin Panel

–

User Panel

– Important security fixes

Admin Panel

– New PHP Versions
– Improvements in the Features module

User Panel

– Fixes in the side menu and dashboard