Part 4 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com By this point I had enough evidence to say: The server had been compromised. I had malicious PHP. I had disguised image files. I had a PHP-based file manager. I had an encoded payload. I had a native executable associated with cryptomining. I had suspicious database activity….

Part 3 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com There was another problem waiting for me after the filesystem investigation. MySQL. And this one was partly my own fault. I had a legitimate reason for allowing remote MySQL connections. Some of my applications live on temporary cloud VPS instances. I create a VPS when I need…

Part 2 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com In Part 1, I stopped the server and started looking at the filesystem instead of immediately trying to get the websites back online. The first confirmed webshell was bf6f03.php. Then I found something more interesting. The attacker had apparently decided that naming a file shell.php was too…

We have all been there. You set up a cool automated workflow—maybe an image captioning AI on a remote GPU server, a sync script for backups, or a quick data fetcher—and suddenly you realize: “Wait, I need this thing to run continuously every couple of minutes.” Just recently, I was working on a project where I needed to sync a…

Part 1 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com My server had been compromised. I didn’t know how badly at first. I had several websites running on the same VPS, and I was already seeing enough strange files and behavior that I knew this wasn’t something I wanted to “fix quickly” and hope for the best….