Security

Total: 21

/go.php?to= Understanding Redirect Scripts

`go.php?to=<url>` is a common pattern for affiliate-link tracking and outbound redirect — but the same pattern is also the textbook open-redirect vulnerability if `to` isn't validated. Walk through how the script typically works, the abuse vector (phishing campaigns hijacking the trusted domain), the right validation (allowlist of destination domains), and modern alternatives.

Published: 15.06.2025

Fixing depth_zero_self_signed_cert in cPanel with a Self-Signed Certificate

For cPanel-managed servers using a self-signed cert (typical on fresh installs before AutoSSL kicks in), git/curl clients return depth_zero_self_signed_cert. Walk through the WHM-level fix (install a Let's Encrypt cert via AutoSSL or manual install) and the per-client trust-the-self-signed workaround for when AutoSSL hasn't completed yet.

Published: 03.05.2026

Fixing depth_zero_self_signed_cert Error in SSL/TLS

The depth_zero_self_signed_cert error is OpenSSL's way of saying "the cert at the bottom of the verification chain is self-signed and not in any trust store." Walk through what depth 0 means, when self-signed is acceptable (development) vs not (production), and the per-context fixes for curl, OpenSSL CLI, Node.js, PHP, and Python clients.

Published: 14.04.2025

Fixing depth_zero_self_signed_cert in cPanel for Git Operations

`SSL certificate problem: depth_zero_self_signed_cert` from git is the OpenSSL "the cert at depth 0 is self-signed and not trusted" message — the remote's cert isn't in your CA bundle. Walk through the per-incident workaround (GIT_SSL_NO_VERIFY for a single command), the per-repo config, and the right long-term fix: importing the issuer into the system trust store.

Published: 12.03.2026

Migrating Away from TimThumb PHP Script: Complete Security Guide

TimThumb is an old PHP image-resizing script that had multiple severe RCE vulnerabilities (CVE-2011-4106 most notably) and is unmaintained. If you inherited a site still using it, walk through identifying instances, the modern replacements (PHP's GD/imagick directly, WordPress's native image sizing, dedicated thumbnailers), and the safe migration path.

Published: 28.07.2025

GlobalSign Domain Verification — Notify GlobalSign & Complete SSL Validation

After publishing the GlobalSign domain-verification TXT record, the final steps are notifying GlobalSign (some workflows auto-detect; others require you to click "Verify Now") and waiting for issuance. Walk through the verification UI flow, debugging when GlobalSign says TXT not found despite `dig` showing it, and the typical timeline.

Published: 28.10.2025

TimThumb.php Overview: Understanding the Deprecated Image Script

TimThumb was a popular PHP image-resizing script in the WordPress / "premium theme" ecosystem from 2008-2014. After several major RCE vulnerabilities, it's unmaintained and dangerous to keep around. Walk through what TimThumb did, the historical features that made it popular, why it's deprecated, modern alternatives, and the migration path.

Published: 28.08.2025

How a System Administrator Solves the _globalsign-domain-verification Issue

Sysadmin angle on GlobalSign DCV: walk through verifying current DNS via `dig`, adding the TXT record server-side (BIND/nsupdate, PowerDNS, Authoritative providers), reloading DNS so the change takes effect, verifying propagation, troubleshooting when GlobalSign still says not found, and the notify-then-wait timeline.

Published: 01.12.2025

How to Delist from SORBS Spam Blacklist

SORBS is one of the older mail blacklists, still consulted by some receivers. Listing causes mail to bounce or be heavily-filtered at affected receivers. Walk through identifying which SORBS list you're on (SOCKS, HTTP, SPAM, DUHL, etc.), the per-list delisting process, the sample appeal letter, and prevention.

Published: 01.07.2025

Revisium Antivirus Overview: Complete Website Security Solution

Revisium Antivirus is a server-side malware scanner for websites — finds webshells, injected JavaScript, modified CMS core files, hidden cron jobs. Walk through what it scans, how it differs from desktop antivirus, the installation flow, integration with cPanel/Plesk, and the pricing model that fits small hosting providers.

Published: 12.08.2025

ElFinder Vulnerabilities — Security Risks & Fixes

Beyond the XSS already covered, ElFinder has had a series of vulnerabilities: arbitrary file read via PHP wrapper paths, RCE via unsanitized upload extension, auth bypass via misconfigured connector. Walk through the known classes of bug, the upgrade-and-config hardening checklist, and the "should I even use ElFinder?" discussion.

Published: 21.02.2026

Bandwidth Limit Exceeded Due to DDoS Attacks

When DDoS traffic burns through your monthly bandwidth cap, the host suspends outbound and your site shows "Bandwidth Limit Exceeded" — same error as legitimate growth, but solved completely differently. Walk through DDoS-vs-organic identification, immediate (Cloudflare + null route), and long-term (rate limit + WAF + scaled bandwidth) mitigation.

Published: 26.08.2025

ElFinder Cross-Site Scripting (XSS) Vulnerability — Exploits & Fixes

ElFinder (the popular file-manager bundled with many CMS plugins) has had several XSS CVEs — file-name reflection, stored XSS via uploaded SVG, mime-type confusion. Walk through how the exploits work, how to patch, and the broader "don't bundle ElFinder in admin UIs" lesson.

Published: 28.12.2025

CubeHosting: DDoS Protection Overview

What CubeHosting's anti-DDoS actually filters, how the protection levels differ (basic / advanced / always-on), and where the inevitable false-positive cases come from. Useful baseline reading for anyone evaluating any provider's anti-DDoS offering.

Published: 26.04.2026

BlacklistAlert: Understanding and Resolving Issues

If your domain or IP is on Spamhaus, SpamCop, or Barracuda, mail bounces and reputation tanks. Walk through why a listing happens (compromised mailbox, open relay, infected workstation sending spam) and the per-blacklist removal process — they're not the same.

Published: 01.07.2025

Fix "The Webmaster Has Forbidden Your Access to This Site" Error

"The webmaster has forbidden your access" is a generic 403 customized by the host. The cause is one of four: your IP is blacklisted on the server (CSF/cphulkd), the site's .htaccess denies you, a WAF rule fires (ModSecurity / Imunify360), or a CMS plugin blocks you. Walk through identifying which.

Published: 01.06.2025

/go.php?to= Understanding Redirect Scripts

Fixing depth_zero_self_signed_cert in cPanel with a Self-Signed Certificate

Fixing depth_zero_self_signed_cert Error in SSL/TLS

Fixing depth_zero_self_signed_cert in cPanel for Git Operations

Migrating Away from TimThumb PHP Script: Complete Security Guide

GlobalSign Domain Verification — Notify GlobalSign & Complete SSL Validation

TimThumb.php Overview: Understanding the Deprecated Image Script

How a System Administrator Solves the _globalsign-domain-verification Issue

How to Delist from SORBS Spam Blacklist

Revisium Antivirus Overview: Complete Website Security Solution

ElFinder Vulnerabilities — Security Risks & Fixes

Bandwidth Limit Exceeded Due to DDoS Attacks

ElFinder Cross-Site Scripting (XSS) Vulnerability — Exploits & Fixes

CubeHosting: DDoS Protection Overview

BlacklistAlert: Understanding and Resolving Issues

Fix "The Webmaster Has Forbidden Your Access to This Site" Error

Hosting

Cloud Solutions

For You

VDS

Website Builders

Our services

Client Area

/go.php?to= Understanding Redirect Scripts

Fixing depth_zero_self_signed_cert in cPanel with a Self-Signed Certificate

Fixing depth_zero_self_signed_cert Error in SSL/TLS

Fixing depth_zero_self_signed_cert in cPanel for Git Operations

Migrating Away from TimThumb PHP Script: Complete Security Guide

GlobalSign Domain Verification — Notify GlobalSign & Complete SSL Validation

TimThumb.php Overview: Understanding the Deprecated Image Script

How a System Administrator Solves the _globalsign-domain-verification Issue

How to Delist from SORBS Spam Blacklist

Revisium Antivirus Overview: Complete Website Security Solution

ElFinder Vulnerabilities — Security Risks & Fixes

Bandwidth Limit Exceeded Due to DDoS Attacks

ElFinder Cross-Site Scripting (XSS) Vulnerability — Exploits & Fixes

CubeHosting: DDoS Protection Overview

BlacklistAlert: Understanding and Resolving Issues

Fix "The Webmaster Has Forbidden Your Access to This Site" Error

Hosting

Cloud Solutions

For You

VDS

Website Builders

Our services

Client Area

Выберите валюту