Cyberpanel got hacked and attacker gets root access

Hi,
Recently I got attacked and its only happening on a server that cyberpanel installed, I think the attacker is exploiting zero days on cyberpanel.
I think the attacker is exploiting lscpd access and then gaining root access from it, and then they changed permitrootlogin on sshd and added their sshkeys on root .ssh, so they gaining permanent access.

I defended mine, please check yours.

Here is the root access log
https://imgur.com/a/q55jBKF

Here is what they do, based on .bash_history
https://imgur.com/a/ewCnw9U

also they have scripted their attacks and gets it using curl, but file is not available anymore
its from here -> http://80.78.18.178/omrig.sh

Unfortunately, some versions of CyberPanel are not secure. Which version are you using?