Long story short, VestaCPs repository got hacked and was used as a relay for passwords being sent by an altered script during the install. Make sure to double check that you aren’t on the list.
Also double check to make sure that /usr/bin/dhcprenew doesn’t exist on your server. If it does double check with strings /usr/bin/dhcprenew
Sure you can be safe staying at home, but wouldn’t you rather ride on top of an airplane wearing a ski mask and a man thong while flipping the world the bird?
Looks like I escaped this one. Not going to complain about that. I’ll take wins where I can get 'em. Rather have everyone off the boxes but at this point it’s “You’re welcome to drink the poison, I’ll do my best to stop it from killing you.”
Security fix for v-open-fs-config. Its visibility is limited to /etc and /var/lib directories
Security check for/usr/bin/dhcprenew binary. If found checker notifies server administrator
Security improvement for sudo. It is now limited to vesta scripts only and doesn’t allow admin to execute any other command
Security improvement: admin password and database passwords are generated individually
Security improvement: new installer doesn’t use c.vestacp.com as source for the configuration files. Configs are bundled inside vesta package
Security improvement: installer doesn’t send any information to vestacp.com after successful installation. It used to send distro name for usage statistics.
