Cyberpanel got hacked and attacker gets root access

ta

tanganpengharapan July 4, 2026, 12:28 a.m. #1

Hi,
Recently I got attacked and its only happening on a server that cyberpanel installed, I think the attacker is exploiting zero days on cyberpanel.
I think the attacker is exploiting lscpd access and then gaining root access from it, and then they changed permitrootlogin on sshd and added their sshkeys on root .ssh, so they gaining permanent access.

I defended mine, please check yours.

ta

tanganpengharapan July 4, 2026, 12:35 a.m. #2

Here is the root access log
https://imgur.com/a/q55jBKF

Here is what they do, based on .bash_history
https://imgur.com/a/ewCnw9U

also they have scripted their attacks and gets it using curl, but file is not available anymore
its from here -> http://80.78.18.178/omrig.sh

AP

Alper Peri July 5, 2026, 5:41 p.m. #3

Unfortunately, some versions of CyberPanel are not secure. Which version are you using?

SD

Sandor Dobi July 12, 2026, 7:38 p.m. #4

Hi I got hacked too with the same method. It was version 2.4.4, but upgrade is not succeed so now I have a broken installation

JV

João Víctor Heleno (João Víctor) July 13, 2026, 2:49 a.m. #5

Same to me. 2.4.4 version. The new 2.4.5 fixed that? Someone can halp me?

AP

Alper Peri July 13, 2026, 7:51 a.m. #6

My advice would be not to use this panel, but if you do, always use the latest version.

SD

Sandor Dobi July 13, 2026, 8:07 a.m. #7

And which panel you advise instead of this?

AP

Alper Peri July 13, 2026, 11:01 a.m. #8

Cloudpanel, aapanel, fastpanel,hestiacp these are alternative panels. For litespeed the aapanel option can be used