How to Stop CyberPanel Cron Emails About “Pending Commits” on Your WordPress VPS

If you host WordPress on a VPS with CyberPanel, you may have woken up one morning to a flood of emails that look like this:

[Daily Cron] Checking if example.com has any pending commits on 07.28.2024_00-00-31.
[Daily Cron] Finished checking for example.com on 07.28.2024_00-00-31.

The frustrating part? You never set up Git. You never touched a deployment pipeline. You’re just running WordPress — and suddenly your inbox looks like something went very wrong with your server overnight. That sinking “did I get hacked?” feeling at 7am is not fun.
I went through this myself. Here’s exactly how I tracked down the source, confirmed nothing bad was actually happening, and made the emails stop for good.

What Causes These Emails?

A scheduled cron task inside CyberPanel is generating them.

CyberPanel ships with a built-in Git automation system aimed at developers who want automatic deployments. Even if you never turned that feature on, the scheduler still runs in the background and spits out log messages. And by default, Linux cron emails any output from a job straight to the system user — so those messages land in your inbox.

The good news:

• This is almost certainly not malware
• Your WordPress content isn’t being uploaded anywhere
• The fix is clean and takes about five minutes

The Quick Fix

If you just want this solved right now:

• Find the cron job running IncScheduler.py
• Redirect its output to /dev/null
• Optionally delete the empty Git placeholder folders

Example:

bash

python /usr/local/CyberCP/plogical/IncScheduler.py > /dev/null 2>&1

That stops the emails without touching anything CyberPanel actually needs.

Step-by-Step Troubleshooting Guide

Step 1 — Find Where the Emails Are Coming From

The message text itself was the first clue:

text

[Daily Cron] Checking if example.com has any pending commits...

That points to a cron job, something Git-related, and some kind of automated check. To find the exact file generating it, run:

bash

sudo grep -R "pending commits" /etc /usr/local /home 2>/dev/null

In my case, the result came back immediately:

text

/usr/local/CyberCP/plogical/IncScheduler.py

Confirmed: the emails were coming from CyberPanel itself, not some rogue process.

Step 2 — Look at the Code Behind It

Check the exact line that prints the message:

bash

sudo grep -n "pending commits" /usr/local/CyberCP/plogical/IncScheduler.py

Output:

text

142: message = '[%s Cron] Checking if %s has any pending commits on %s.'

Then view the surrounding code to understand what it’s actually doing:

bash

sudo sed -n '120,170p' /usr/local/CyberCP/plogical/IncScheduler.py

Two lines stood out:

python

for website in os.listdir(IncScheduler.gitFolder):

python

resp = wm.commitChanges(1, data)

So CyberPanel has a real Git automation system — it can check repos, auto-commit changes, and sync deployments. This wasn’t random noise. It was a feature I didn’t know I had running.

Step 3 — Find the Git Configuration Folder

Next, figure out which folder CyberPanel is actually scanning:

bash

sudo grep -n "gitFolder" /usr/local/CyberCP/plogical/IncScheduler.py

Output:

text

44: gitFolder = '/home/cyberpanel/git'

Now look at what’s in there:

bash

sudo ls -lah /home/cyberpanel/git

I saw this:

text

drwxr-xr-x 2 cyberpanel cyberpanel 4.0K Apr 18 02:59 domain.com
drwxr-xr-x 2 cyberpanel cyberpanel 4.0K Apr 18 02:59 panel.domain.com

My domains were listed. At that point I genuinely thought something had been configuring Git behind my back.

Step 4 — Check Whether Anything Is Actually Configured

This is the step that made me breathe again. Run:

bash

sudo find /home/cyberpanel/git -type f

Result:

text

(no output)

The folders existed, but they were completely empty. No Git config files, no remotes, no repositories — nothing. CyberPanel had created placeholder directories for each domain but never put anything in them.

What this means:

• No repositories were actually configured
• Nothing was syncing to GitHub or GitLab
• No automatic commits were running
• The scheduler was just looping through empty folders and printing status messages to nowhere

That’s it. That’s the whole “incident.”

Step 5 — Understand Why Cron Sends the Emails

Linux cron has one simple rule: if a job produces any output and that output isn’t redirected, cron emails it to the local system user. CyberPanel’s scheduler prints a status line for every domain it checks, those lines go to stdout, and cron dutifully forwards them to your inbox every single day.

The Fix

Option 1 — Silence the Emails (Recommended)

Find the cron entry first:

bash

sudo grep -R "IncScheduler.py" /etc/cron* /var/spool/cron 2>/dev/null

You’ll see something like:

bash

python /usr/local/CyberCP/plogical/IncScheduler.py

Change it to:

bash

python /usr/local/CyberCP/plogical/IncScheduler.py > /dev/null 2>&1

That redirects both standard output and error output to /dev/null. Cron has nothing to email. Problem solved, and CyberPanel keeps working normally.

Option 2 — Remove the Empty Placeholder Folders

Since those Git folders are empty, you can safely delete them:

bash

sudo rm -rf /home/cyberpanel/git/domain.com
sudo rm -rf /home/cyberpanel/git/panel.domain.com

This may stop the scheduler from mentioning those domains at all.

Errors I Hit Along the Way

The first one is: sed: unknown command: ‘S’

I initially ran sed with placeholder text instead of real line numbers:

bash

# Wrong:
sudo sed -n 'START,ENDp' file

# Right:
sudo sed -n '120,170p' file

sed needs actual numbers, not labels.

The second one is: ModuleNotFoundError: No module named ‘plogical’

I tried to inspect the Python module directly:

bash

sudo python3 -c "from plogical.IncScheduler import IncScheduler; print(IncScheduler.gitFolder)"

That failed because CyberPanel uses its own Python environment with custom module paths. Skipping that entirely and just using grep to read the source file directly was simpler and worked fine.

What I Took Away From This

• The emails came from CyberPanel’s built-in Git scheduler — not malware, not a breach
• The Git folders were empty placeholders; nothing was actually syncing anywhere
• Redirecting cron output to /dev/null is the cleanest fix
• If you run your own VPS, it’s worth knowing what your hosting panel is doing in the background — CyberPanel ships with Git deployment tools, background schedulers, and automation frameworks that run whether you use them or not

Periodically checking your cron jobs, background services, and outbound connections is a good habit. Not because something is necessarily wrong, but because you should know what your server is up to.