enetworkassociates

The bug could let an attacker take over a system just by sending it malicious compressed data, with no login needed. That works both ways: a hacker could hijack an unpatched server, or a malicious server could hijack an unpatched user’s device. "During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. Source: https://x.com/OpenAI/status/2113766354386084338 More details on the patch and mitigations below: Patch the PlanetBrotli vulnerability (CVE-2026-111497) — Patch the PlanetBrotli decoder vulnerability: affected software, fixed releases, and how to disable Brotli decoding while you patch.

A THIRD remote code execution vulnerability has JUST been disclosed, only 48 HOURS after PHP released emergency patches for two critical security flaws. And this one is STILL UNPATCHED. Here's what we know: NEW RCE DISCOVERED: CVE-2026-115560 could allow attackers to remotely execute malicious code on affected PHP servers. NO PATCH AVAILABLE: Even servers updated with Wednesday's emergency security fixes aren't patched against this new vulnerability. SPECIFIC CONFIGURATIONS AT RISK: The flaw requires an unusual combination of PHP session settings and application code. DEFAULT FEATURE INVOLVED: PHP's session upload progress feature is enabled by default and is part of the vulnerable configuration. OFFICIAL MITIGATION: PHP recommends setting session.upload_progress.enabled=0 until the next release. THIRD RCE IN 48 HOURS: Two critical flaws were patched Wednesday. Now another has been disclosed before a fix is available. PHP powers nearly 70% of websites with a known server-side language. THREE remote code execution vulnerabilities disclosed in just DAYS. And now another reminder that even applying the latest security patches doesn't guarantee you're protected against every newly discovered flaw. "Only a narrow setup is at risk. PHP says the problem can occur when a web application does all of the following: sets the session.serialize_handler option to php_binary or php_serialize in its configuration, then changes that option to php while running by calling ini_set(), and makes that change before it calls session_start(). Session upload progress must also still be turned on. An application that never changes the serialize handler while running can leave the feature on and is not exposed through this path. PHP says this setup is unlikely in practice. The action is one line. PHP recommends setting session.upload_progress.enabled=0 until the next routine bugfix release. This is the same setting it already listed as a mitigation in the October 21 advisory for CVE-2026-109619." [link to thehackernews.com (secure)] uploadprogress : An extension to track progress of a file upload. Trun it off! (For now) : session.upload_progress.enabled=0

Again my thanks to Sandeep re php-manager I got the 8.5.12 update.

Two critical remote code execution flaws in PHP, dubbed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619), forced governments and major organizations worldwide to take websites offline on Wednesday, October 21, 2026, as the language powers roughly 70% of the internet. The vulnerabilities, rated 9.2/10 on the CVSS scale, allow attackers to execute code on servers without authentication or a password, potentially stealing credentials, API keys, and user data. PHP2Shell comprises two critical remote code execution (RCE) vulnerabilities (CVSS 9.2) tracked as CVE-2026-109618 and CVE-2026-109619. They affect all PHP versions serving web requests across PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP project released emergency patches in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. [1, 2] The Vulnerabilities CVE-2026-109618: An out-of-memory (OOM) error handling flaw. If PHP runs out of memory while setting up request data, the process interrupts and treats partially initialized data as valid, leading to RCE. [1, 2] CVE-2026-109619: A stale global state flaw where request-specific internal state survives after its memory is freed. A subsequent request handled by the same worker can misuse that stale data before initialization resets it. [1, 2] Highest Risk: Setups using Apache with mod_php are considered most vulnerable, allowing unauthenticated attackers to execute arbitrary code before any application code runs. [1, 2] How to Fix & Mitigate Update Immediately: Upgrade your PHP runtime to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or apply backported packages from your Linux distribution or long-term support (LTS) vendor. [1] Apply WAF / Edge Rules: Deploy web application firewall rules (such as those provided by Cloudflare) to block oversized POST bodies or suspicious payloads. [1, 2] Isolate Unpatched Systems: If an instance cannot be patched right away (such as end-of-life PHP branches), CISA and the NCSC advise taking the affected system offline or restricting public network access behind a VPN or firewall. [1, 2] SO NOW I HAVE TO FIGURE OUT HOW TO UPGRADE TO 8.5.12 - CWP ONLY HAS UP TO VERSION 8.5.9

Thanks for this Sandeep. Do you think your will integrate it into CWP? I appreciate the thought that went into it and that the TUI has options/ variables visually displayed, that goes a long way in making it a tool that people will use without having to be specific command or syntax fluent to get waht needs to be done. Soon Sandeep I will be sending you a little something so you can buy yoirself a coffee or something. Again, your devops and sharing is appracited.

This might help (?): https://forum.centos-webpanel.com/centos-webpanel-bugs/cve-2025-48703-cve-2026-57517-the-gsocket-systemd-backdoor-cwp-s/

I had issues with zlib not being available with a fresh CWP install in Alma 9.XX 8.5 got installed, it just took more time and trouble shooting than I would have liked.

CWP has recently started kicking out this and other like warnings for me as well...

Over the years I made some sloppy edits and god knows what tech support might have done DNS records. I used Gemini's cli tools to do an audit of the DNS and email Deliverability. This saved me soooo much time and frustration. The following is published here "https://i-cloud.ltd/cwp-dns-manual/" and you can get the script and manual for this Download Manual (TXT) & Download Sync Script (Python) CWP DNS Auditing, Automation for CoudFlare DNS Synchronization, and Gmail (Email) Deliverability Manual Authoritative Synchronization between CWP Control Web Panel and Cloudflare Contributor Attribution: J:Mc @ i-cloud.ltd 1. IntroductionManaging DNS records across multiple domains is one of the most critical yet error-prone tasks for a system administrator. While CentOS Web Panel (CWP) provides a robust environment for local mail and web hosting, maintaining consistency with external DNS providers like Cloudflare often requires tedious manual entry. Small discrepancies such as a mismatched DKIM key or malformed SPF records can instantly degrade a domain's sender reputation, causing legitimate emails to be flagged as spam or rejected entirely by providers like Gmail and Outlook. This manual outlines a standardized, CLI-driven workflow to automate the synchronization of local server records with Cloudflare, ensuring 100% compliance with modern email deliverability standards. 2. Core Purpose & Strategic ValueThe primary objective of this automation is to ensure that the "local reality" of the server (the keys and IPs actually in use) is perfectly reflected in the "public reality" of the global DNS. Key Use Cases:Production Environment Drift: Over time, manual edits or CWP updates can lead to duplicate SPF records or redundant MX entries. This process identifies and prunes those errors automatically. Server Migration Scenarios: When moving domains to a new server or a new IP address, the ability to bulk-update records across dozens of zones via the CLI saves hours of manual UI work. New Server Provisioning: During initial builds, the workflow allows you to generate keys locally and "push" them to Cloudflare in seconds. Automated "Overwrite" Logic: Our CLI approach performs a true "diff," deleting stale records and updating active ones to ensure a clean, authoritative state. Associated Files:Download Manual (TXT)Download Sync Script (Python) 3. Preliminary ConfigurationCloudflare API IntegrationSecurity is paramount. Create a scoped token in the Cloudflare Dashboard with Zone - DNS - Edit and Zone - Zone - Read permissions. Use IP filtering to restrict the token to your server's IPv4 address. Server-Side Preparation# Initialize a isolated environment python3 -m venv venv source venv/bin/activate # Install required dependencies pip install cloudflare httpx4. Local BIND Audit & CorrectionBefore syncing, the local BIND zone files (/var/named/*.db) must be syntactically correct. Quoting TXT Records: Ensure all TXT values, particularly DMARC and SPF, are enclosed in double quotes. SPF Optimization: Use a clean IP-based string: "v=spf1 +a +mx +ip4:YOUR_SERVER_IP ~all" Zone Reloading: sudo rndc reload domain.com 5. Executing the SynchronizationWe utilize the sync_cloudflare_dns.py script to perform the synchronization. # 1. Export Token export CLOUDFLARE_API_TOKEN='your_secret_token' # 2. Validation (Dry-Run) python3 sync_cloudflare_dns.py domain.com local_template.txt # 3. Execution python3 sync_cloudflare_dns.py domain.com local_template.txt --run6. Global Deliverability ChecklistSPF: Single, valid record including your server's IPv4. DKIM: Public key in Cloudflare must exactly match the server key. DMARC: A policy of at least p=none; p=quarantine is recommended. Network Protocol: Force mail traffic over IPv4 if IPv6 PTR is missing: sudo postconf -e "inet_protocols = ipv4" && sudo systemctl restart postfix I hope this is useful to you.

Is Sandeep OK? I have been wondering this for some months. I asked about paid support like I have in times past back in June and I did not hear back from him. I do care to know he is OK. I appreciate forum this one and the original and the excellent consise private support. @Sandeep B. How are you bro? - John In Vancouver British Columbia Canada here. I hope all is well. Please post so there is proof of life :-) Blessings.

I found a glitch. @ /admin/index.php?module=csfofficial There is no more ConfigServer Scripts ConfigServer Firewall There is just a bank page with this header / title "csfofficial" Log viewer and firewall tools are missng. Has anyone else found this as well and if so is there a fix or is it lost without dev.configserver.com ?

Applied this fix. Went from 14.26 to 15.0 without any hiccups using starburt's supplied config. Then I looked at the issue further and found that Aetherinox / csf-firewall was prbably going to be most supported and having a help community if needs be. So I cahttr -i the conf files, edited them, then I chattr +i them again and did an update via CWP and not the command line.using Aetherinox / csf-firewall brought the version upto date at V 15.07 Not sure what made me look but I was doing some admin and looked at Way to the Web Ltd in a csf file and looked up and Configserver.com to find out that it has closed down permanently. Note: I was thinking at first the CWP would update the package sourses in cwp script/s update. I went ahead without nowing if they had or had not. @TheHolbi @Starburst @Sandeep B. Is CWP going to update CWP with a new cfs repository / source? Will it hoop our fire walls if we took matters into our own hands by using the examples above? Is CWP going to pull from the Aetherinox / csf-firewall frok?

🍿

@Sandeep B. I am going to be doing a server migration. and doing a fresh CWP install on the existing one and before I build and rebuild a server... Is CWP Pro ready for Almalinux 9? CWP HQ says "AlmaLinux 9 has some missing features" What missing features? Is there a list / link to specs? development updates? I am running php 8.2 & 8.3 for WorPress and Nextcloud nginx/apache/Varnish/modsec/ Anyways thanks for the feed back.

Thank-You Sandeep. I will look into it.