Unfortunately they are still able to install their tool despite me upgrading the system yesterday, what could I do ? Its the .x folder
So your system is already compromised, upgrading patches the system but you need to kill the running service and cleanup your machine.
Someone may be able to point you in the right direction in cleaning up.
Follow these links:
Critical Security Alert: Vulnerable CyberPanel Instance Detected on Your Network - Support and Discussion - CyberPanel Community