Hidden plugin installers, a crypto miner, a chat backdoor and IP grabbers.

Each file was decompiled and checked by hand. I reported the ones still online to CurseForge and Modrinth today.

• DelexeHub, BedWars Minigame, BestKitPvP, EasyGUIShop, HubParkour, AntiFreecam, Better Horse Teleport, AntiNetherRoof Plus: a download address hidden in Base64 fetches another jar at startup, saves it in your plugins folder and loads it. Look for jars you did not add, like BukkitScheduler.jar, BukkitSupport.jar or SpigotSupport.jar.
• PGCVisibility 1.0.0: downloads xmrig and mines Monero on your server. Version 1.2.0 is clean.
• PlayerLocation, BerryAntiCheat, LippelHome: the same injected code, which loads a jar from a fake bStats host (panel.bstats.co). It looks like it spreads into other plugins on the same server.
• SimpleMute: any chat message starting with a secret prefix runs as a shell command on the machine. It also sends your server IP and port out at startup.
• End Control: loads a jar from a hidden address through a fake BungeeCord class.
• SCF Slime Chunk Finder: loads code from a hidden address at startup.
• Anti Hack for updated versions: a GrimAC copy that posts your server IP and port to a Discord webhook.

If you ran any of these: remove it, check your plugins folder for jars you did not add, and treat the machine as compromised. Change passwords, rotate keys and tokens, and reinstall if you can.

I listed every plugin with exactly what its file does: https://modgrade.com/reports (I run that site, it checks mods, modpacks and plugins from CurseForge and Modrinth).

You can also drop your whole plugins folder into https://modgrade.com/scanner to check it.

If you made one of these and think it’s a mistake, tell me and I’ll look again.

I'm trying to make a leaderboard with ajleaderboards for ajparkour's highest streak and its not showing the right numbers for the streak. For example, I have a 80 high score, but on the leaderboard, its only showing 10. I'm using the tag "ajpk_stats_highscore" when making it, but it doesn't work. When I do "/papi parse me %ajpk_stats_highscore%" to check if its outputting the right data, it says it is, just not on the leaderboard. Any help?

I made a hub for my server using multiverse core. I want people to do /hub to teleport to the hub server, but also /spawn puts them in the survival world using essentials. Is there a hub plugin to allow me to do this, or is there a way I can set this up without the hub plugin?

LLM disclosure (rule 9):

- Model: Claude (Anthropic), used through Claude Code.

- Code: Claude wrote part of it, about 20% by my own estimate, and I wrote the rest. I decide what gets built, and I review the changes and run the test suite (about 280 tests) before anything goes in.

- Copy: the website text, the FAQ and this post were written with Claude's help, then edited by me.

- The repo has a progress.md and agent config files, because I work with Claude sessions on parts of the project.

Hey all, I’m the dev, so yes, this is self-promo. If it breaks a rule here, tell me and I’ll take it down.

You’ve seen this a hundred times in help channels. Someone pastes 4,000 lines of log into Discord, it gets cut off halfway, the file has their IP and Windows username in it, and the helper still can’t find the crash. That’s why I built minelog. https://minelog.org

I know mclo.gs exists and it’s good, I’ve used it for years. I’m not trying to replace it. I just wanted a few things on top, mostly privacy and the server side.

The simple part: paste a server log, client log or crash report and you get a short link back. No account needed.

What it does:

• Hides IP addresses, user folder names, tokens and emails in your browser first, then again on the server before anything is saved.
• Reads the log for you. You get the Minecraft and Java versions, the mod list, and the usual crash causes, each with the lines that back it up.
• Highlights errors and warnings, lets you link to a single line, and has search and filters.
• Logs delete themselves after 120 days. If private details weren’t hidden, after 2 days.

The server side, for admins:

• A plugin for Paper, Spigot, Purpur, Folia, BungeeCord, Waterfall and Velocity. Run /minelog share and the link lands right in chat.
• If you connect a server to your account, the plugin watches the log, groups the errors and saves them under Alerts. It can also ping a Discord, Slack, Teams, Google Chat, Telegram, Guilded or Mattermost webhook when something breaks, or when the server starts and stops.
• There’s Skript support too, so you can react to TPS drops or send your own alerts from a script.

For developers:

• A public API for uploading, reading and deleting logs, and for analysing one without saving it.
• There’s also an endpoint that matches mclo.gs, so tools built for it keep working. You just swap the address.

It’s free. The code is on GitHub (https://github.com/LogicByteORG/minelog), but heads up, it’s source available under PolyForm Shield, not open source. You can read it, run it and send fixes. You just can’t launch a competing log site with it.

It’s still new, so I’d like to hear where it breaks. If you have a weird log or crash report it reads wrong, send it over and I’ll add a rule for it.

Im working on setting up a server for 10people. We bought a Nitrado server with 8GB ram.
We want to install thinks like:
- Simple Voice
- Performance Mods / Plugins
- little "mods" like invisible Itemframes
All of these mods / plugins are fabric.

I dont know how to set this up.. my biggest questions are:
What shoud u use? at the moment i have Minecraft (Modpack) on the server, but should i use Bukket / Spigot?
And maybe some more thinks to setup and install.. Pls help me (Links also work)

Current specs of my old PC

-Ryzen 5600x3d

-32GB ddr4 3600mhz RAM

-512GB nvme m.2

I want to host a 50 player pixelmon server. It has a hub world, a custom main map and three mini game worlds.

It will be on a Windows 11 with MC Server Soft

i am hosting a server with around 100 players and i want to make sure it can hold up i have access to server console and is there any mods that can help me stress test the server

Thanks to the mod team for allowing a repost after I made it source-available.

TailCraft is a free Windows GUI launcher for hosting a Minecraft server for friends without the usual setup pain — no port forwarding, no manual Java install, no digging through server jars.

What it does

- Run one EXE → pick a language (EN/KO) → an 8-step tutorial walks you to a running server.

- Server types: Paper, Purpur, Folia, Fabric, NeoForge, Forge, and Arclight (Bukkit plugins on a modded server). Versions/builds load automatically; the right Java (8/17/21/25) is installed for you.

- Connect 3 ways: Tailscale (no port forwarding), port forwarding (with UPnP), or LAN. Folia is port-forward-only by design.

- Live dashboard (CPU/RAM/disk/players), Modrinth mod & plugin manager, player tools (whitelist/OP/kick/ban, nickname+IP), console with quick-commands, a separate event-log tab, and one-click diagnostics.

On the concerns raised last time

- Source-available: the full source (launcher.ps1 + lib/core.ps1, the Go EXE wrapper, PDF build scripts) is on GitHub so anyone can audit it. The license keeps modification/redistribution restricted, but reading and auditing is the whole point.

- No bundled third-party software. No server jar, Java, or Tailscale client is included. Everything is downloaded at runtime from official sources (PaperMC, FabricMC, NeoForged, Forge, Modrinth, Adoptium, Tailscale) at the user's choice — so I'm not redistributing Tailscale or anything else.

- Integrity check: the EXE verifies the SHA-256 of its bundled script at launch and refuses to run if tampered with. The official hash is published in the README so you can verify your download with certutil.

Unofficial tool, not affiliated with Mojang/Microsoft/Tailscale/PaperMC/etc. Windows 10/11.

Source + README: https://github.com/lapic121/tailcraft

Download: https://lapic121.github.io/tailcraft/

Happy to take feedback or questions.

Hi everyone,

I want to host an All the Mods 9 (ATM9, the regular version) Minecraft server on my laptop, while playing on my separate gaming PC.

My laptop specs:

• CPU: Intel Core 7 150U (10 cores, 12 threads)
• RAM: 16GB DDR5
• Storage: 512GB SSD

The laptop will only run the server, not the Minecraft client.

I'm planning to allocate around 12GB of RAM to the server and have 4–5 players playing together.

My questions:

1. Is this CPU powerful enough to run ATM9 smoothly with 4–5 players?
2. Will 8GB of RAM be enough for the server?
3. What kind of performance should I expect during exploration and when players build large automated farms?
4. What settings or optimizations would you recommend?
5. Would I need a more powerful CPU, or is my current laptop good enough?

I'd appreciate advice from anyone who has hosted ATM9 on similar hardware. Thanks!

Hi everyone,

I’m hosting a Minecraft Java Edition server using Paper and Playit.gg, and I’m having trouble connecting through my custom domain.

Here’s my setup:
Server software: Paper
Tunneling service: Playit.gg
DNS: I configured a CNAME record pointing to my Playit.gg hostname.

Limitation: My domain provider doesn’t support SRV records, so I can only configure a CNAME record.
Connecting directly through the Playit.gg address works, but connecting through my custom domain doesn’t.

Since I can’t use SRV records with my domain provider, is there any way to make the custom domain work for Minecraft Java Edition using only a CNAME record?

I’d appreciate any suggestions or alternative solutions. Thanks!

Since Ivw been planning to create a server like this (or at least a system/plugin for it for others) for months now, Id like to know if there are people here who actually play on (MMO)/RPG servers. If so, what do you like the most? Is it a certain feature? The story? The quests? Or something that no other RPG servers have?

For example, my current plan includes a main story written (by a person) that spans several pages in Word, and Im still working on it because its very complex and really hard to create a story (features, quests, etc.) that makes sense.

I just want to hear your thoughts on this specific category.

Hello decided to transition my 26.2 paper server over to fabric 26.3 today and i have had a few issues. Most notably grim anticheat seems not to to want to load with the latest version of packet events I'v tried using an older version of packet events but that doesn't work either, if someone does know how to fix the issue I would be so greatful to hear it

https://mclo.gs/y6lG12z

Howdy y’all,

Just wanted to give everyone a heads up, especially those of you who self-host Pterodactyl and haven’t updated things in a while. (Guilty myself)

On October 21st, two critical PHP vulnerabilities were disclosed, CVE-2026-109618 and CVE-2026-109619. Both can potentially allow remote code execution (RCE), meaning under the right conditions someone could execute code on the machine running your panel without needing to authenticate.

This isn’t specifically a Pterodactyl vulnerability, it’s an issue with PHP itself, which Pterodactyl uses for its web panel. Not every installation is necessarily exploitable, but it’s definitely something worth checking.

I came across this while working on my own hosting software and figured I’d share it here too.

A few things worth knowing:
- Pterodactyl’s developers have already made changes to both the 1.x and 2.x development branches to mitigate part of the risk associated with CVE-2026-109619. So credit where it’s due, they have been addressing it.

- Those changes aren’t a replacement for updating PHP itself. The PHP security team recommends updating to fully address both vulnerabilities.
If you’re running your panel through Docker, check the PHP version inside the actual container. Updating PHP on your host machine won’t necessarily update the container.

- If you’re renting a Minecraft server from a hosting company, you probably don’t need to worry about updating PHP yourself. Your host would handle that. But even if you have no idea what panel they’re using, it wouldn’t hurt to ask if they’re aware of the recent PHP vulnerabilities and whether any updates are needed on their end. Not every hosting company uses Pterodactyl, but PHP is used in plenty of other applications too.

Patched PHP versions:
PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12

Obviously, use a version that’s supported by your particular Pterodactyl installation. Some Linux distributions also backport security fixes, so the version number alone isn’t always the whole story.

Sources for anyone wanting to look into it

Official PHP security announcement:
https://www.php.net/archive/2026.php#2026-10-21-5

CVE-2026-109618:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

Pterodactyl’s changes on the 1.x branch:
https://github.com/pterodactyl/panel/commit/90b2aa87469da4fffd941b3c99f3c1ca48a01b78

Pterodactyl’s changes on the 2.x branch:
https://github.com/pterodactyl/panel/commit/3824a0a0dea88fd1f53e76618a6df75e91d1b57c

Not saying everyone’s installation is vulnerable or that there’s some widespread attack happening. Just figured with how many Minecraft servers and other communities rely on Pterodactyl, it was worth putting this out there.

If you haven’t checked your panel and PHP versions recently, I’d recommend doing so.

Stay safe everyone!

———
Edit 1:

u/FrisbeeVR brings up a good addition:
> Should assume vulnerability if you have a web service period. Any panel, not just the one you mentioned, or those maps that you access through a website.

Right now I have multiverse core and made a hub in a super flat world, I used essentials to set the spawn point to the hub, I have citizens npc's to teleport you to different worlds. How would I fix this to where if you did /spawn it puts you to the survival spawn, but also make another command like /hub to teleport you to the hub?

Some background: As the jank server owner I am, I'm running a server off of a broken laptop with Windows Home. I was originally planning on installing a debian server distro on it, but for reasons that could be described as "outlandishly evil", the BIOS is inaccessible without the original (broken) screen and the manufacturer has refused to walk me through it blind.

So I am stuck with a Windows Home installation. I am a Linux user.

After several hours of fighting obscene Windows configuration panels, I have a setup where I can SSH in and the server works perfectly...except that Windows doesn't have `nohup` or `screen` or `tmux`, so when the SSH session closes, the server dies.

Remote Desktop is evidently not an option, and I have been struggling with poorly-written PSSession documentation for five hours. Can someone please be my knight in shining armor and tell me how to simply disconnect the process from the shell? Or perhaps some other secure and lightweight method by which I can maintenance the server over LAN? (Web GUIs are not a secure and lightweight method.)

It's been an issue as long as I can remember, prolly since horses were added, but now that i'm hosting I want to see if I can fix the bastard

Accompanied by the "XXXXXXX (vehicle of XXXXXXX) moved wrongly!" error message flood without any server stress or lag

Particularly egregious example

Hi everyone,

I’m the admin of a Minecraft server for a group of friends. We have a dedicated spawn island that players can teleport to via command, with several leaderboards and NPCs.

For Halloween, I want to temporarily turn the spawn island into a dark, spooky and slightly foggy area without affecting the rest of the world.

My server runs Paper, and I’m using WorldEdit, WorldGuard, Axiom, Citizens and AJLeaderboards. Most of our players also use Sodium-based client setups and shaders, so ideally I’m looking for a solution that doesn’t rely on a custom resource pack or something that would break with Sodium/shaders.

What would be the best way to create a foggy atmosphere that is limited to the spawn island? I don’t want to lock the weather or time of day for the entire map.

One idea I had was to move/rebuild the spawn island in the Nether, specifically in a Basalt Deltas area, to take advantage of the naturally dark and grey atmosphere there. I could then use commands or a WorldGuard region to give players the Darkness effect while they are on the island.

Would that approach work well, or is there a better server-side solution for creating localized fog/darkness? I’m slowly running out of ideas, so I’d really appreciate any suggestions.

Disclaimer (This is no server advertisment)

Thanks in advance!

Hello, so I am interested in making heuristic AC for minecraft that would detect accuracy, jumpresets, crosshair movement, crits, sweeps etc.

I would also like to investigate tick desync, tick phases and clock drift in minecraft. I only know c# does anyone have any reccomendations where to start besides learning java. WOuld also like to make a mod to fix this. Where do i start besides java

Hey everyone!

I’m experiencing lag spikes on my Minecraft server and would appreciate some help figuring out what’s causing them.

Server specs:
CPU: AMD Ryzen 7 5700X
RAM: 24 GB allocated to the Minecraft server
Software: Paper

I’ve already pre-generated the world using Chunky, but we’re still experiencing TPS drops and high MSPT spikes.

I’ve created a Spark profile to help identify the issue:
Spark Profile: https://spark.lucko.me/m4P9FxMUUa
Does anyone have any idea what might be causing these lag spikes or what I should investigate next?
Any help or suggestions would be greatly appreciated. Thanks!

Hi everyone, I'm trying to set up a crossplay server for 1 Java PC player and 2 PS5 players, and the PS5 can't connect. Java works fine.

Setup:

- Host: play.hosting (Pterodactyl)

- Paper 26.3, Geyser 2.12.0 (build 1268), Floodgate 2.2.5 (build 141), GeyserUpdater

- I first used play.hosting's automatic crossplay feature, then rebuilt everything manually on a fresh server. Same result.

What I tried:

- Bedrock Connect and BedrockTogether on the PS5: neither works.

- Adding the server directly with IP and port: doesn't work either.

- The same PS5 joins other servers without problems.

- I installed Geyser on Aternos and the PS5 connected immediately.

Errors on the PS5:

1. "An error occurred" (Return to Menu / View Details) with the note: Search help.minecraft.net for "Boat"

2. "Multiplayer connection failed. Your client is having trouble connecting to multiplayer services. Check your internet connection, restart your client, and try again." with the note: Search help.minecraft.net for "NetherNet"

What I found:

- The Geyser console warns: "NetherNet support is NOT enabled" (RakNet is supposed to stop working with Bedrock 26.60 on Oct 27).

- I set bedrock.transport to both (also tried nethernet) in plugins/Geyser-Spigot/config.yml, with the server fully stopped. After every start it's back to raknet.

- Geyser starts on UDP port 1220, not the default 19132, so I suspect the host configures Geyser at startup (config parser in the egg, or a system property like -DgeyserTransport). My start command shows no such flag: java -Xms128M -Xmx$((3072 - 1024))M -Dterminal.jline=false -Dterminal.ansi=true -jar server.jar

- The console shows "[Pterodactyl Daemon]: Updating process configuration files..." on every start.

My questions:

1. Is the NetherNet error on my PS5 really the cause of the failed join, or is something else going on?

2. Has anyone run Geyser with NetherNet on play.hosting, and how did you stop transport from being reset?

3. Is there any way to set transport without editing config.yml?

4. Do I need a second UDP port for webrtc-port, and does it work on shared hosts?

Thanks for any help!

I own a realistic nations roleplay server with a lot of advanced features and intentionally challenging systems. The problem is that new players often join and immediately feel lost. Some leave quickly because they can’t figure things out, while others need staff to walk them through almost everything.
We have signs, a detailed wiki, and regularly answer questions in Discord and in-game when staff are available. Even with that, personally guiding everyone hasn’t been sustainable.
I’d like to give players a simple starting gameplay loop so they can get settled and enjoy the server before diving into the more complicated systems.
I also suspect part of the problem is that we’re new and the player economy isn’t established yet. Players who mainly want to roleplay still have to spend a lot of time gathering supplies in the resource world because there aren’t enough businesses or suppliers to buy from.
We originally wanted to avoid admin shops because we were worried players would rely on them instead of gathering resources, opening businesses, and trading with each other. But we’re now considering a minimal admin shop for basic necessities to help people get started while the player economy develops.

For anyone who has dealt with this:

What kind of tutorial or onboarding system actually worked?

How do you introduce complex mechanics without overwhelming people?

How do you get a new player economy running without making everyone gather and produce everything themselves?

Have you found a balance where minimal admin shops help players without replacing player businesses?
Any suggestions or examples would be appreciated.

Hello im working on a server that needs areashop to work, /balance and addsign doesnt work and doesnt apear in chat with any errors and all /as commands doesnt give any commandfeedback

I know this subreddit is mostly focused on Java, but I'm sharing and looking for feedback on a project I've been working on, a management platform for Bedrock Dedicated Servers that automates the ability to install addons from CurseForge.

I'll also be completely upfront that this is 100% vibe coded using ChatGPT/Codex lol.

Let me know if you have any questions!

https://github.com/Nerd-Turtle/Chroma