The most useful thing in an incident isn’t a scary-looking file. It’s the sequence of events. By SepedaTua — CrushEdge.com After I had enough evidence to know which files were malicious, I wanted to answer the question that had been bothering me since the beginning: When did the attacker actually get in? This sounds simple. It isn’t. A compromised server…
Read More »
The files that finally made me stop guessing and start believing the evidence By SepedaTua — CrushEdge.com At some point during the investigation, I stopped asking: “Was the server hacked?” That question was already answered. The better question was: “What exactly did the attacker leave behind?” That changed the investigation completely. Instead of staring at thousands of normal WordPress files,…
Read More »
What I checked after the websites came back online By SepedaTua — CrushEdge.com There is a very satisfying moment during a server recovery. You start Apache. You start MariaDB. You open the browser. And: After two days of downtime, that feels like the finish line. It isn’t. It’s more like the point where I can finally start checking whether the…
Read More »
Why I stopped exposing MariaDB just because a temporary server needed database access By SepedaTua — CrushEdge.com This was one of the parts of the incident that bothered me after everything was restored. Not because MariaDB itself was necessarily the problem. The problem was how convenient I had allowed remote database access to become. At some point, I had a…
Read More »
Fixing the Missing torchaudio Dependency When Training FLUX LoRA on RunPod You spent your hard-earned cash renting a beefy GPU instance on RunPod, prepped your dataset, generated your captions, and wrote your configuration file. You hit enter to start training your FLUX.1 LoRA, and BAM! Terminal throws a fat Python error: ModuleNotFoundError: No module named ‘torchaudio’. If you have ever…
Read More »
Because the best time to notice a new webshell is before the attacker has had three days to use it. By SepedaTua — CrushEdge.com After restoring a compromised server, I don’t want to spend the next six months manually running: every morning. That works during an incident. It doesn’t scale as a habit. What I want instead is a small…
Read More »