cPanel theme "1" suddenly appeared.

Anyone else got a new theme suddenly appeared named "1"? It doesn't do anything if the user tries to switch to it from within cpanel - but if they do - and log out, when they log back in they get a blank screen.

This theme doesn't appear in the "Branding" section of WHM but it does appear in /usr/local/cpanel/base/frontend/1 although the only files that exist seem to be related to plugins such as Softaculous, Attracta and LVE stats etc.

I haven't done anything to create this and it would seem it has happened on most of servers (but not all) within the last 24 hours.

 

Running Release tier. What these servers have in common is that they are mostly new servers where all accounts have been transferred over. The dates on the oldest files in the /usr/local/cpanel/base/frontend/1 directory could tie in with the date the accounts were transferred on each server.

Many of these users may have previously been using old X and X2 themes - so I'm wondering if somehow the transfer process created this additional "1" theme as a result of those being missing on the new servers.

Files are being updated in this theme directory but I was wrong in thinking the entire directory was created within the last 24 hours, so it would appear not to tie in with the release of 11.50 as I had suspected.

I can't see any evidence of malicious activity. I would be interested to know if there is a scenario whereby this theme directory could get automatically generated by some cpanel/WHM process.