The final practical part of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com The restore was the easy part. The harder question was: How do I make sure I don’t have the same problem again next week? I could restore the websites from a known-good backup, start Apache and MariaDB, and call it a day. That would be…

We’ve all been there: you trigger a fresh build, take a quick sip of coffee, and wait for your Flutter app to spin up on your test phone. Everything looks smooth until Gradle hits the compilation phase, chugs for a few minutes, and slams you with a wall of red text. If your terminal just threw an error that looks…

Part 5 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com By now, the server was restored. That was the part I cared about most. But I didn’t want this whole incident to end with: “Well, I got hacked, restored a backup, and hopefully everything is fine.” That’s not very useful to anyone else. So I took the…

If you run automated backups, sync log files, or work with data export scripts, Google Drive can quickly turn into a dumping ground. Last week, while cleaning up some folder structures, I found thousands of stray .txt files scattered across subfolders. Clicking them one by one in the web browser was out of the question—unless I wanted my weekend stolen…

Part 4 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com By this point I had enough evidence to say: The server had been compromised. I had malicious PHP. I had disguised image files. I had a PHP-based file manager. I had an encoded payload. I had a native executable associated with cryptomining. I had suspicious database activity….

Part 3 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com There was another problem waiting for me after the filesystem investigation. MySQL. And this one was partly my own fault. I had a legitimate reason for allowing remote MySQL connections. Some of my applications live on temporary cloud VPS instances. I create a VPS when I need…