Files disappeared from the server

[Deepak]

Hello Marcus!

@eris

This is ridiculous the bug has been patched in 1.8

Thanks for your reply.

Oops, did I miss something?

Is php-fpm safe to use on 1.8.x stable or on 1.9.x-alpha today? I was refering to the exploit reported by Mr. Smitka in the following thread here:

Is Hestiacp secure from local attack?

Hello Mr. Smitka! Thanks for your marvellous research and identification of this security flaw. Would you please be kind to confirm that the following is true: Statement: If we do not use PHP-FPM at the moment or deactivate it until the HestiaCP team offers a solution, then it should be fine. Looks very logical be I want an answer from you. This vulnerability is triggered only through a local access, where an user having access to the system can elevate rights and cause damages. Sta…

If yes, then I would be shocked because there was someone, who had uploaded one zip file on my VPS. There was no other framework based project installed at this time. There were only simply php scripts installed on my non-commercial project that would not give any possibility to make changes in the php.ini and upload etc.

But php-fpm was installed at the time of uploading. This was before one month and I used HestiaCP 1.8.12. So if the explaoit reported by Mr. Smitka was removed i.e. patched in this version, then I will have to be much more vigilant and check that out.

BTW, I have never ever used Wordpress. Nor I ever had clients or external people having any access on my VPS. The zip was uploaded on the domain running with hestia version 1.8.12. Thus, I removed php-fpm and installed 1.9-alpha.