ConfigServer Community Forum

No, as you can write your regex to take care of all PHP versions in just one line.

your email is telling that your PHP exceeded the time allowed to run
Exceeded : 1801 > 1800 (seconds)

So, with that rule you will let PHP to use the time needed.

I had the same issue and what I did in cPanel was to create an email filter to delete those emails and for me that was the only way to get rid of them.

The best way to go is to create your own SPAMASSASSIN RULE and tell your cPanel customers not to add their own domains in MailScanner WhiteList. I mean, if the hacker is impersonating you and you have your own domain in your MailScanner White List, then the spoofed email will go thru. So, if you cus...

ok, this will help you:
in csf.pignore add:

exe:/opt/cpanel/ea-php74/root/usr/bin/php

Try this:

Try the following REGEX instead:

Just curious,
Why did you wrote those " * " on the following line?

pcmd:*/usr/local/cpanel/3rdparty/wp-toolkit/plib/vendor/wp-cli/wpt-wp-cli\.php*

Have you tried to add those IPs at CSF.IGNORE?

@Sergio - here is another IP from the same domain that has been blocked. There are hundreds of similar lines, so I copied all the ones that were different from each other. On another note, I don't understand why this is so challenging to do on CSF. On other FWs, you can simply put in a rule that es...