Part 3 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com There was another problem waiting for me after the filesystem investigation. MySQL. And this one was partly my own fault. I had a legitimate reason for allowing remote MySQL connections. Some of my applications live on temporary cloud VPS instances. I create a VPS when I need…

Part 2 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com In Part 1, I stopped the server and started looking at the filesystem instead of immediately trying to get the websites back online. The first confirmed webshell was bf6f03.php. Then I found something more interesting. The attacker had apparently decided that naming a file shell.php was too…

We have all been there. You set up a cool automated workflow—maybe an image captioning AI on a remote GPU server, a sync script for backups, or a quick data fetcher—and suddenly you realize: “Wait, I need this thing to run continuously every couple of minutes.” Just recently, I was working on a project where I needed to sync a…

Part 1 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com My server had been compromised. I didn’t know how badly at first. I had several websites running on the same VPS, and I was already seeing enough strange files and behavior that I knew this wasn’t something I wanted to “fix quickly” and hope for the best….

When a Linux server suddenly reports 99% disk usage, it’s tempting to start deleting old home directories, backups, or log files. I almost went down that road too. In my case, this happened on a Virtualmin server hosting multiple WordPress websites. At first glance, /home looked like the biggest directory, so I checked whether an old user directory could be…