This is part of what the developer released to fix the security vulnerability disclosed responsibly on WHT [1] tl;dr of that thread by the OP [2] . Beyond the r

This is part of what the developer released to fix the security vulnerability disclosed responsibly on WHT [1] tl;dr of that thread by the OP [2] . Beyond the ridiculous response of the developer in the thread, the fix released doesn't even fix the issue. Some other security researcher released the root vuln [3] and basically every install of this software is about to be rooted. And that's all before the ridiculousness of passing a root password over http, which strips "special characters" that is used to login to your box and upgrade their software. If you read the linked thread, it's like a case study on how to NOT respond to a security disclosure. [1] - http://www.webhostingtalk.com/showthread.php?t=1275572 http://www.webhostingtalk.com/showthread.php?t=1275572 [2] - http://www.webhostingtalk.com/showpost.php?p=8727714&postcount=148 http://www.webhostingtalk.com/showpost.php?p=8727714&postcou... [3] - http://localhost.re/p/zamfoo-120-vulnerability http://localhost.re/p/zamfoo-120-vulnerability