Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday. This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices (e.g., TP-Link and Netgear routers) and enterprise systems (e.g., Fortinet and Cisco appliances, PRTG and CyberPanel servers). Through it, the …

Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on Wednesday. This network, dubbed Silent Train by the researchers, consists of chains of compromised SOHO and IoT devices (e.g., TP-Link and Netgear routers) and enterprise systems (e.g., Fortinet and Cisco appliances, PRTG and CyberPanel servers). Through it, the …

A practical guide to self-hosting apps in a containerized environment with Docker. We’ll cover setup using SSH, control panels like Plex and CyberPanel, and templates from popular hosting providers.

## ServerPilot alternatives in 2026: the short answer The three ServerPilot alternatives worth using in 2026 are CyberPanel, aaPanel and CloudPanel. Each has a free edition you install on your own VPS. ServerPilot is still alive and still works well, but it charges per server and per app, so the bill grows every time you add a client site. A control panel is a web dashboard that installs and manages your web server, PHP, databases and SSL. I have moved client sites from ServerPilot to all three panels below. New to this? Start with what self-hosting means. ## What ServerPilot actually costs in 2026 (and what it doesn't do) ServerPilot costs $5 to $20 per server plus $0.50 to $2 per app each month, on top of your cloud bill. It is a SaaS that manages a server you rent from DigitalOcean, AWS, Google Cloud, UpCloud or Linode. Plans are billed hourly, with a 14-day free trial and no card needed: * **Economy:** $5/server + $0.50/app per month * **Business:** $10/server + $1/app per month * **First Class:** $20/server + $2/app per month It installs Nginx in front of Apache (for `.htaccess` rules), PHP-FPM, MySQL, multiple PHP versions, AutoSSL, automated security updates, an iptables firewall and one-click WordPress, with app isolation. It is a PHP-only tool: no email server, no DNS management and no one-click Node.js or Python. Economy has almost no monitoring. Logs and server metrics start at Business; per-app and MySQL metrics need First Class. ## CyberPanel: free, full-featured and fast on OpenLiteSpeed **Verdict:** CyberPanel is the best free pick if you need email, DNS and a file manager in one panel for mostly WordPress sites. It is open source and built on OpenLiteSpeed, a free web server. The free tier includes unlimited domains, SSL, DNS, mail, FTP, a file manager, MySQL, backups, a Docker manager, a WordPress manager, a firewall and cron. ### Where CyberPanel wins * Websites and client email live on one box for $0. * Updates ship very often, so security fixes land fast — and you cannot safely skip them. ### Where CyberPanel hurts * OpenLiteSpeed is not a drop-in replacement for Apache. Some `.htaccess` rewrite rules need hand-tuning. * Paid LiteSpeed Enterprise is billed per server. The free Starter licence caps you at 1 domain and 2GB RAM. Site Owner is $11/month (5 domains) and Web Host Lite is $28/month (unlimited domains). ## aaPanel: the most features for a one-time price **Verdict:** aaPanel is the right choice for a cPanel-style dashboard with multiple users, if a China-based project is acceptable. It is the international edition of BT Panel, with 200+ releases since 2017 and, by its own site's claim, installs on 3,000,000+ servers. The free-for- life edition has no domain limit and includes mail, FTP, MySQL, a file manager with a code editor, cron and Docker. ### Where aaPanel wins * Pro is a lifetime licence, not a subscription. 2026 promotions ran at about $399. * Pro adds sub-accounts for shared-hosting setups, an Nginx WAF (web application firewall), file protection, bulk mail and the WP Toolkit. ### Where aaPanel hurts * The free panel has an account and telemetry tie-in. Flag this if a client has data-residency or supply-chain rules. * English docs lag behind the Chinese ones. * Some Pro features are per-seat extras. ## CloudPanel: free, minimal and the lightest of the three **Verdict:** CloudPanel is the closest free replacement for ServerPilot, because it does hosting well and deliberately skips everything else. It has no paid tier, no email server, no DNS server and no web file manager. You upload files over SFTP instead. ### Where CloudPanel wins * The memory footprint is tiny. Its docs say a properly optimised 4GB RAM server can carry roughly 10–15 busy websites. * You get PHP (many versions), Node.js and Python sites, per-site databases and users, auto-renewing Let's Encrypt, a reverse proxy and Varnish-style caching. * It runs on Ubuntu, Debian, Rocky Linux 9 and AlmaLinux 9, on x86 or ARM64. ### Where CloudPanel hurts * It refuses to install if Apache, Nginx or MySQL is already present, so you must start from a fresh OS. * The minimum is 1 core, 2GB RAM and 10GB disk, but I would not go below 2 cores. Before any panel install, I run two checks on the new VPS: free -h systemctl list-units --type=service | grep -E 'apache2|nginx|mysql' The first shows RAM; the second should print nothing. If it lists a service, reinstall the OS. My NGINX reverse proxy guide covers custom proxy setups. ## Side-by-side comparison ServerPilot is the only option here with no free tier; the other three cost nothing to start. Panel| Cost (2026)| Built-in email| File manager| Reverse proxy / caching| Best for ---|---|---|---|---|--- ServerPilot| $5/server + $0.50/app| No| No (SFTP only)| Nginx in front of Apache| Hands-off PHP and WordPress hosting CyberPanel| Free (open source)| Yes| Yes| OpenLiteSpeed with LSCache| WordPress plus client email aaPanel| Free; Pro lifetime about $399| Yes| Yes| Nginx; WAF on Pro| Multi- user hosting CloudPanel| Free (no paid tier)| No| No (SFTP only)| Built-in reverse proxy and page caching| PHP, Node.js and Python apps ## $0 vs $38 a month: a real cost example Three client VPS with 8 apps cost $38 a month on ServerPilot Business and $0 on CloudPanel. (3 servers × $10) + (8 apps × $1) = $38/month $38 × 12 = $456/year CloudPanel handles a setup this size comfortably, and CyberPanel on OpenLiteSpeed is also $0. The 1-domain, 2GB RAM cap applies only to the free Starter LiteSpeed licence. In rupees, $38 is over ₹3,000 a month, while many of my Indian clients pay ₹400–₹800 for a Contabo or Hetzner box. Panel fees that cost more than the server itself are the biggest reason people leave ServerPilot. Count your hours too: the migration is a weekend if you do it yourself, or one to two days of paid work. > Pick the panel that fits the apps you actually run, not the one with the > longest feature list. ## Other ServerPilot-style tools worth knowing If you would rather pay for a hosted dashboard: * **RunCloud:** no free tier since 2024. Pricing runs about $8–9/month for single-server Basic, $15 for Pro and $45 for Business, and it feels the most like ServerPilot. * **Ploi:** a genuinely usable free tier (1 server, 1 site, 5 deployments a month), then €8/$10 Basic, €13/$16 Pro and €30/$36 Unlimited. Its MCP server lets Claude, ChatGPT or Cursor drive your servers. * **SpinupWP:** WordPress only. It costs $12/month (Essentials) or $19/month (Advanced) for one server with unlimited sites, plus about $1/month per extra server. * **Laravel Forge:** roughly $12, $19 and $39 a month, billed per account rather than per server. It also handles Rails, Go, Node and Python. ## Which one I would install for your case The right panel depends on email, app types and who needs a login: * **WordPress plus client email on one VPS:** CyberPanel. * **Reselling cheap hosting with a login per customer:** aaPanel Pro, if supply-chain rules allow it. * **Mixed PHP, Node.js and Python apps on a 2–4GB box:** CloudPanel. * **You never want to SSH in and are happy to pay monthly:** Ploi or RunCloud. * **A Laravel or multi-language dev team:** Laravel Forge. My Proxmox beginner guide covers spinning up a throwaway VM, and the WireGuard VPN guide keeps panel logins off the public internet. ## Frequently asked questions ### Is CyberPanel really free? Yes. CyberPanel on OpenLiteSpeed is free and open source with unlimited domains. You only pay if you move to a paid LiteSpeed Enterprise licence, which starts at $11/month. ### Do I need a control panel at all if I know Linux? No, but once you pass two or three sites a panel saves real time. It mostly automates SSL renewals, per-site users and safe client logins. ### What is the closest thing to ServerPilot? RunCloud is the closest paid replacement and CloudPanel the closest free one. CloudPanel sticks to hosting like ServerPilot, and it also runs Node.js and Python. ### Can I migrate from ServerPilot without downtime? Yes, if you build the new server beside the old one. Copy files and databases, test through your hosts file, and lower the DNS TTL (how long resolvers cache records) a day early. Switch DNS, run a final database sync, then cancel ServerPilot. ## Final Thoughts ServerPilot is still a good product, but charging per server and per app hurts small budgets. CloudPanel replaces it for most of my clients. If you need email, choose CyberPanel, and for multi-user hosting, choose aaPanel. If you want help setting up Nextcloud, Jitsi, Matrix or Moodle, or a careful panel migration off ServerPilot, get in touch here. Before any work starts, I will tell you honestly which panel fits.

Build a mail server from a bare VPS with CyberPanel, then get it to 10/10 on mail-tester: PTR, SPF, DKIM, DMARC, and the OpenDKIM milter trap.

CyberPanel pre-auth RCE chain lets attackers gain shells on vulnerable servers by abusing AI Scanner flaws, stored XSS, and cron jobs.

CyberPanelに新たに公表された未認証のリモートコード実行脆弱性チェーンにより、攻撃者が認証なしで公開サーバーを侵害できる恐れがあります。 Pentera社の研究者Nir Chako氏によって「ShadowPanel」と名付けられたこの攻撃は、同プラットフォームのAI Scannerコンポーネントの弱点と組み込

研究者らは、CyberPanelにおいて認証前のリモートコード実行(RCE)が可能となる脆弱性チェーンを明らかにしました。これにより、インターネット上の攻撃者が資格情報を一切持たずに、脆弱なサーバー上でコマンドを実行できる可能性があります。Hacking& Cracking この攻撃は、公開状態にあったAI

you are silent on how you installed Flatpak on Chromebook in the first place and whether other Flatpaks have been installed and run successfully. Perhaps time to step back and review your installation of Flatpak from the beginning? CyberPanel – 13 Jan 25 ### How to Install Flatpak on Chromebook – Easy Guide Learn how to install Flatpak on Chromebook and Linux with step-by-step instructions. Expand your app options today with secure and versatile Flatpak! and then progress from there

you are silent on how you installed Flatpak on Chromebook in the first place and whether other Flatpaks have been installed and run successfully. Perhaps time to step back and review your installation of Flatpak from the beginning? CyberPanel – 13 Jan 25 ### How to Install Flatpak on Chromebook – Easy Guide Learn how to install Flatpak on Chromebook and Linux with step-by-step instructions. Expand your app options today with secure and versatile Flatpak! and then progress from there

Security researcher Thanatos has uncovered a critical vulnerability (CVE-2024-53376) in CyberPanel, a popular web hosting control panel, that could allow attackers to completely compromise servers. Versions of CyberPanel prior to... The post CVE-2024-53376: CyberPanel Flaw Exposes Systems to Full Compromise, PoC Published appeared first on Cybersecurity News.

The Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in CyberPanel, an open-source web hosting control panel. This flaw, tracked as CVE-2024-51378, is being actively exploited... The post CVE-2024-51378 (CVSS 10): Critical CyberPanel Flaw Under Active Attack, CISA Warns appeared first on Cybersecurity News.

A vulnerability in CyberPanel's WebTerminal allows attackers to bypass authentication and gain root access.

Over 22,000 CyberPanel instances exposed online to a critical remote code execution (RCE) vulnerability were mass-targeted in a PSAUX ransomware attack that took almost all instances offline. [...]

Urgent security updates needed for Zyxel, CyberPanel, North Grid, & ProjectSend due to critical vulnerabilities. #Cybersecurity #Vulnerability #CISA

Join us for a special WGU partner hosted webinar exploring how AI powered threats are reshaping cybersecurity.

The agency urged federal civilian agencies to patch a vulnerability that impacts a widely used file-sharing product from the software company Cleo.