Yesterday as I was making some development to an upcoming project for TheWebmastersCafe.net, some of my websites have been defaced by ZorroKin. He used a VHCS2 exploit to create an admin account on the control panel and then he created himself a few FTP accounts to deface some areas of my websites.

Fortunately I had been lucky enough because he could have done a lot more damages. Going through my log files, I have been able to track pretty much everything he’s done and as I noticed the intrusion early, I’ve banned his IP on my firewall. I know it’s not that hard to get in using another IP but anyway it may have given me a few minutes to react to the attack.

I had been a bit lazy lately as I knew I had to replace my outdated VHCS2 control panel by something a lot better but I always pushed that back. So now I guess is a good time to do it because even though I tracked what he as done on my server, I can’t be 100% sure he doesn’t have an access anymore. You can get more information on the VHCS exploit here and you can get the VHCS security patch here.

I just got myself a brand new VPS with cPanel and I am moving all my websites to the new server so updates to TheWebmastersCafe.net may be a little slow this week.

PHP 5 has already been out for more than three years now and version 6 is on it’s way. PHP developers recently announced on php.net that there will be no further releases of PHP version 4 although security fixes will continue on a case-by-case basis until August 8th 2008. PHP 4 scripts should be converted to version 5 by the end of 2007.

Conversion to PHP 5 has been really slow. According to Nexen.net for August 2007, 78% of websites are still using PHP 4. PHP 4.4.7 is still the popular choice while PHP 5.2.3 is good second.

PHP.net has a migration guide for PHP4 to PHP5 as well as guides for PHP 5.0 to 5.1 and PHP 5.1 to 5.2.

If you are using CentOS 4, I’ve written an article about migrating from PHP 4.3.9 to 5.1.6.

I’ve added a Wordpress plugin so that a full RSS feed of TheWebmastersCafe.net is now available.