Part 2 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com In Part 1, I stopped the server and started looking at the filesystem instead of immediately trying to get the websites back online. The first confirmed webshell was bf6f03.php. Then I found something more interesting. The attacker had apparently decided that naming a file shell.php was too…

We have all been there. You set up a cool automated workflow—maybe an image captioning AI on a remote GPU server, a sync script for backups, or a quick data fetcher—and suddenly you realize: “Wait, I need this thing to run continuously every couple of minutes.” Just recently, I was working on a project where I needed to sync a…

Part 1 of a real-world WordPress VPS compromise investigation By SepedaTua — CrushEdge.com My server had been compromised. I didn’t know how badly at first. I had several websites running on the same VPS, and I was already seeing enough strange files and behavior that I knew this wasn’t something I wanted to “fix quickly” and hope for the best….

When a Linux server suddenly reports 99% disk usage, it’s tempting to start deleting old home directories, backups, or log files. I almost went down that road too. In my case, this happened on a Virtualmin server hosting multiple WordPress websites. At first glance, /home looked like the biggest directory, so I checked whether an old user directory could be…

If you’re running a Debian VPS with Virtualmin and MariaDB, sooner or later you’ll run into the same problem I did: your root partition is almost full, but MariaDB needs even more space to rebuild a huge table. In my case, I needed to add a generated column and a unique index to an 11 GB InnoDB table. Unfortunately, MariaDB…