INCIDENT 2026-08-15 04:26:00 trigger: mysql_conn=32 ================================================================== load: 4.98 2.57 1.45 1/607 2454306 ncpu:10 mem_avail: 7085MB/11729MB (60.4%) swap_used:1217MB swapout:0/s blocked(D):0 running:1 iowait:0.0% steal:0.0% php: 0 procs / 0MB heaviest user: - (0 procs, 0MB) apache: 28 procs tcp_estab: 26 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2255 root 240 967 nobody 27 362 netdata 8 260 dovenull 6 28 wp-toolkit 6 20 cpanellogin 1 17 mailman 20 14 infinium 1 13 lowrange 1 12 kurri 1 12 candyfabcom 1 12 zabbix 1 11 mailnull 2 10 dovecot 3 8 named 1 7 nscd 1 4 evolution 4 3 dbus 1 3 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2614 MB Active(file): 2370 MB Inactive(file): 579 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 504 MB CommitLimit: 9960 MB Committed_AS: 6557 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 03:14:45 5296 /usr/bin/imunify-agent-proxy 2444340 root 14:30 62836 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 1420296 1 mysql 2309980 10.9 Ssl 1-02:47:00 /usr/sbin/mariadbd 1220 1 netdata 212296 2.5 Ssl 46-18:16:03 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2390233 2382613 root 184228 0.0 S 01:50:23 spamd child 2382613 1 root 173944 0.0 Ss 02:02:49 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2390234 2382613 root 160280 0.0 S 01:50:23 spamd child 2444340 1 root 62836 0.2 Ssl 14:30 /opt/imunify360/venv/bin/python3 -m imav.run 159820 1 root 54468 0.0 Ss 25-18:39:11 /usr/lib/systemd/systemd-journald 2223 1201 root 53972 0.0 Sl 46-18:16:02 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 40996 0.0 Ss 24-01:44:33 cpsrvd (SSL) - waiting for connections 1469 1 root 40824 0.1 Ss 46-18:16:02 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2454281 1469 root 38340 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 32576 0.1 Sl 46-18:15:58 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2381704 1 root 32376 0.0 Ss 02:03:48 lfd - sleeping 2446242 1353308 cpanellogin 18368 0.0 S 11:08 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base default_login_theme cpanel server_locale en 2452477 1276780 nobody 17796 0.1 S 01:34 /usr/sbin/httpd -k start 2452657 1276780 nobody 17020 0.0 S 01:23 /usr/sbin/httpd -k start 2452651 1276780 nobody 17004 0.0 S 01:23 /usr/sbin/httpd -k start 2452633 1276780 nobody 16912 0.0 S 01:24 /usr/sbin/httpd -k start 2452777 1276780 nobody 16708 0.0 S 01:16 /usr/sbin/httpd -k start 2453856 1276780 nobody 16684 0.0 S 00:33 /usr/sbin/httpd -k start 2452653 1276780 nobody 16404 0.0 S 01:23 /usr/sbin/httpd -k start 2453510 1276780 nobody 16372 0.0 S 00:52 /usr/sbin/httpd -k start 2452603 1276780 nobody 16368 0.0 S 01:26 /usr/sbin/httpd -k start 2453690 1276780 nobody 16336 0.0 S 00:42 /usr/sbin/httpd -k start 2453768 1276780 nobody 16312 0.0 S 00:40 /usr/sbin/httpd -k start 2453586 1276780 nobody 16268 0.0 S 00:50 /usr/sbin/httpd -k start 2453577 1276780 nobody 16256 0.0 S 00:51 /usr/sbin/httpd -k start 2453199 1276780 nobody 15968 0.0 S 01:06 /usr/sbin/httpd -k start 2454120 1276780 nobody 15364 0.0 S 00:16 /usr/sbin/httpd -k start 2454067 1276780 nobody 15300 0.0 S 00:19 /usr/sbin/httpd -k start 185104 2431 netdata 14780 2.0 Sl 2-07:52:21 /usr/libexec/netdata/plugins.d/apps.plugin 1 1601939 1471 root 14488 0.0 S 21:13:03 cPhulkd - dbprocessor 2451284 1276780 nobody 14224 0.0 S 03:42 /usr/sbin/httpd -k start 2448769 1276780 nobody 14020 0.0 S 07:21 /usr/sbin/httpd -k start 1463 1 root 14016 0.0 Ss 46-18:16:02 tailwatchd 2454004 1276780 nobody 13860 0.0 S 00:22 /usr/sbin/httpd -k start 2448334 1276780 nobody 13712 0.0 S 08:01 /usr/sbin/httpd -k start 2451495 1276780 nobody 13436 0.0 S 03:29 /usr/sbin/httpd -k start 2427121 3828812 infinium 13336 0.0 S 44:32 dovecot/imap 2454118 1471 root 13236 0.0 S 00:16 cPhulkd - processor - http socket 2454247 3828812 candyfabcom 13108 0.0 S 00:06 dovecot/imap 2429477 3828812 lowrange 12968 0.0 S 40:43 dovecot/imap 2436820 3828812 kurri 12820 0.0 S 28:22 dovecot/imap 1471 1 root 12572 0.0 Ss 46-18:16:02 cPhulkd - processor 1204 1 zabbix 12080 0.2 Ssl 46-18:16:03 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2448825 1276780 nobody 12080 0.0 S 07:19 /usr/sbin/httpd -k start 2453576 1276780 nobody 12032 0.0 S 00:51 /usr/sbin/httpd -k start 2451070 1276780 nobody 11816 0.0 S 04:06 /usr/sbin/httpd -k start 2451855 3828812 root 11488 0.0 S 03:00 dovecot/auth -w 1059098 3828812 dovenull 8608 0.0 S 1-12:53:08 dovecot/imap-login 1059102 3828812 dovenull 8176 0.0 S 1-12:53:08 dovecot/imap-login 2454233 281734 mailnull 7980 0.0 S 00:07 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3651102 1 root 7628 0.0 Ss 7-02:03:16 queueprocd - waiting up to 60s to process a task 1466 1 root 7408 0.0 Ss 46-18:16:02 dnsadmin - dormant mode 2536732 1 named 7204 0.0 Ssl 43-02:03:50 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 1 0 root 7108 0.2 Ss 46-18:16:11 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 2423771 1 root 6936 0.0 SN 49:59 ConfigServer Version Check 1574 1 wp-toolkit 6404 0.0 Ss 46-18:16:02 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1059100 3828812 dovenull 6308 0.0 S 1-12:53:08 dovecot/pop3-login 1578 1 wp-toolkit 6176 0.0 Ss 46-18:16:02 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4002354 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min customc/customcentral.com.au-ssl_log 408 alison/alisonarts.com.au-ssl_log 117 vinesit/westpanel.vinesit.com.au-ssl_log 44 whiz/whizengineering.com.au-ssl_log 44 tubesupplies/tubesupplies.com.au-ssl_log 43 vinesit/westpanel.vinesit.com.au 43 evolution/portal.evolutionerp.com.au-ssl_log 16 tubesupplies/tubesupplies.com.au 11 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 343 34.11.22.191 117 20.226.112.14 87 20.250.27.191 58 20.226.61.190 50 20.104.100.201 44 20.100.177.66 16 203.54.180.238 6 118.127.40.55 2 91.92.243.243 1 57.141.16.13 1 40.77.167.132 1 35.233.149.97 --- top request paths across all vhosts (last 3 min) --- 16 GET /heartbeat.php 9 GET / 6 POST /wp-cron.php 4 GET /1.php 3 GET /wp-temp.php 3 GET /wp-includes/ID3/about.php 3 GET /wp-includes/blocks/details/ 3 GET /wp-includes/blocks/audio/ 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /wp-admin/css/colors/modern/ 3 GET /wp-admin/css/ 3 GET /this_is_a_new_hello_world.php 3 GET /system_log.php 3 GET /puc.php 3 GET /pucci.php 3 GET /makeasmtp.php 3 GET /k.php 3 GET /BDKR28WP.php 3 GET /admin.php 3 GET /about.php --- busiest 3 vhosts: top paths + last 10 requests --- == customc/customcentral.com.au-ssl_log == -- top paths -- 9 GET / 4 POST /wp-cron.php 1 GET /.zsh_history 1 GET /yj09.php 1 GET /xyn.php 1 GET /x.php 1 GET /www/.env 1 GET /wp-ws68.php 1 GET /wp-temp.php 1 GET /wp-sitemap-taxonomies-product_cat-1.xml 1 GET /wp-sitemap-taxonomies-category-1.xml 1 GET /wp-includes/Text/ -- last 10 requests -- 20.226.61.190 - - [15/Aug/2026:04:25:48 +1000] "GET /puc.php HTTP/1.1" 404 5750 "-" "-" 20.226.61.190 - - [15/Aug/2026:04:25:49 +1000] "GET /wp-includes/Requests/ HTTP/1.1" 404 5750 "-" "-" 20.226.61.190 - - [15/Aug/2026:04:25:49 +1000] "GET /8.php HTTP/1.1" 404 5750 "-" "-" 34.11.22.191 - - [15/Aug/2026:04:25:49 +1000] "GET /?exec=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 301 - "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)" 34.11.22.191 - - [15/Aug/2026:04:25:49 +1000] "GET /?command=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; OAI-SearchBot/1.3; +https://openai.com/searchbot)" 34.11.22.191 - - [15/Aug/2026:04:25:49 +1000] "GET /?cmd=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" 34.11.22.191 - - [15/Aug/2026:04:25:49 +1000] "GET /?host=%3B+echo+GSCAN_CMDI+%23 HTTP/1.1" 301 - "-" "Mozilla/5.0 (compatible; Google-Extended/1.0; +http://www.google.com/bot.html)" 20.226.61.190 - - [15/Aug/2026:04:25:50 +1000] "GET /1.php HTTP/1.1" 404 5750 "-" "-" 34.11.22.191 - - [15/Aug/2026:04:25:50 +1000] "GET /?exec=%3B%20echo%20GSCAN_CMDI%20%23 HTTP/1.1" 200 97044 "https://customcentral.com.au/?exec=%3B+echo+GSCAN_CMDI+%23" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; 20.226.61.190 - - [15/Aug/2026:04:25:51 +1000] "GET /about.php HTTP/1.1" 404 5750 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 1 GET /yellow.php 1 GET /xxxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x.php 1 GET /xeqdlun.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php 1 GET /ws38.php 1 GET /ws37.php -- last 10 requests -- 20.226.112.14 - - [15/Aug/2026:04:25:53 +1000] "GET /file17.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:54 +1000] "GET /shell.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:55 +1000] "GET /file15.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:55 +1000] "GET /file30.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:56 +1000] "GET /bless5.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:57 +1000] "GET /wp-is.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:57 +1000] "GET /hook.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:58 +1000] "GET /wp-configs.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:59 +1000] "GET /mini.php HTTP/1.1" 401 36 "-" "-" 20.226.112.14 - - [15/Aug/2026:04:25:59 +1000] "GET /class19.php HTTP/1.1" 401 36 "-" "-" == vinesit/westpanel.vinesit.com.au-ssl_log == -- top paths -- 1 GET /xxx.php 1 GET /wp-temp.php 1 GET /wp.php 1 GET /wp-includes/Text/Diff/Engine/about.php 1 GET /wp-includes/Requests/ 1 GET /wp-includes/l10n/ 1 GET /wp-includes/js/jquery/ 1 GET /wp-includes/ID3/about.php 1 GET /wp-includes/blocks/details/ 1 GET /wp-includes/blocks/audio/ 1 GET /wp-includes/block-bindings/ 1 GET /wp-content/themes/index.php -- last 10 requests -- 20.250.27.191 - - [15/Aug/2026:04:25:18 +1000] "GET /wp-includes/Text/Diff/Engine/about.php HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:20 +1000] "GET /cgi-bin/admin.php HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:22 +1000] "GET /wp-content/ HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:24 +1000] "GET /simple.php HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:26 +1000] "GET /xxx.php HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:27 +1000] "GET /hypo.php HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:29 +1000] "GET /wp-admin/css/colors/blue/ HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:31 +1000] "GET /chosen.php HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:34 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 500 718 "-" "-" 20.250.27.191 - - [15/Aug/2026:04:25:35 +1000] "GET /als.php HTTP/1.1" 500 718 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 04:23:31 L1=1.30 run=1 blk=0 avail=6936 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=20 tcp=18 topuser=- 2026-08-15 04:23:39 L1=1.33 run=2 blk=0 avail=6910 (58.9%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=54 ap=20 tcp=17 topuser=speedlin 2026-08-15 04:23:41 L1=1.33 run=2 blk=0 avail=6702 (57.1%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=261 ap=20 tcp=18 topuser=madalice 2026-08-15 04:23:49 L1=1.51 run=1 blk=0 avail=6929 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=22 topuser=- 2026-08-15 04:23:51 L1=1.51 run=1 blk=0 avail=6929 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=19 topuser=- 2026-08-15 04:23:59 L1=1.35 run=2 blk=0 avail=6821 (58.2%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=136 ap=21 tcp=22 topuser=tubesupplies 2026-08-15 04:24:01 L1=1.35 run=1 blk=0 avail=6925 (59.0%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=18 topuser=- 2026-08-15 04:24:09 L1=1.14 run=3 blk=0 avail=6885 (58.7%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=73 ap=20 tcp=25 topuser=madalice 2026-08-15 04:24:11 L1=1.14 run=1 blk=0 avail=6919 (59.0%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=21 tcp=23 topuser=- 2026-08-15 04:24:19 L1=1.20 run=1 blk=0 avail=6928 (59.1%) swpO=0 conn=2 myRSS=2277 php=0 phpRSS=0 ap=20 tcp=20 topuser=- 2026-08-15 04:24:21 L1=1.20 run=3 blk=0 avail=6921 (59.0%) swpO=0 conn=1 myRSS=2277 php=0 phpRSS=0 ap=20 tcp=23 topuser=- 2026-08-15 04:24:29 L1=1.57 run=2 blk=0 avail=6710 (57.2%) swpO=0 conn=2 myRSS=2277 php=1 phpRSS=144 ap=36 tcp=38 topuser=tubesupplies 2026-08-15 04:24:31 L1=1.57 run=3 blk=0 avail=6699 (57.1%) swpO=0 conn=1 myRSS=2277 php=1 phpRSS=150 ap=35 tcp=52 topuser=tubesupplies 2026-08-15 04:24:39 L1=2.53 run=10 blk=0 avail=6181 (52.7%) swpO=120 conn=2 myRSS=2274 php=9 phpRSS=894 ap=48 tcp=37 topuser=customc 2026-08-15 04:24:41 L1=2.53 run=2 blk=0 avail=6740 (57.5%) swpO=120 conn=1 myRSS=2274 php=1 phpRSS=89 ap=45 tcp=23 topuser=tubesupplies 2026-08-15 04:24:49 L1=3.49 run=2 blk=0 avail=6819 (58.1%) swpO=0 conn=2 myRSS=2274 php=0 phpRSS=0 ap=43 tcp=26 topuser=- 2026-08-15 04:24:51 L1=3.49 run=24 blk=0 avail=5375 (45.8%) swpO=0 conn=23 myRSS=2274 php=23 phpRSS=2193 ap=41 tcp=58 topuser=customc 2026-08-15 04:24:59 L1=5.12 run=3 blk=0 avail=6674 (56.9%) swpO=270 conn=2 myRSS=2267 php=2 phpRSS=225 ap=52 tcp=28 topuser=madalice 2026-08-15 04:25:03 L1=4.87 run=26 blk=0 avail=4893 (41.7%) swpO=225 conn=27 myRSS=2267 php=26 phpRSS=2689 ap=49 tcp=52 topuser=customc 2026-08-15 04:25:09 L1=4.56 run=34 blk=0 avail=5878 (50.1%) swpO=0 conn=33 myRSS=2267 php=32 phpRSS=1964 ap=48 tcp=54 topuser=customc 2026-08-15 04:25:14 L1=5.79 run=5 blk=0 avail=6500 (55.4%) swpO=44 conn=27 myRSS=2267 php=5 phpRSS=486 ap=53 tcp=29 topuser=customc 2026-08-15 04:25:19 L1=5.41 run=33 blk=0 avail=5288 (45.1%) swpO=48 conn=32 myRSS=2267 php=31 phpRSS=2504 ap=49 tcp=55 topuser=customc 2026-08-15 04:25:24 L1=7.06 run=8 blk=0 avail=6513 (55.5%) swpO=1669 conn=7 myRSS=2255 php=7 phpRSS=530 ap=54 tcp=32 topuser=customc 2026-08-15 04:25:30 L1=6.73 run=17 blk=0 avail=6019 (51.3%) swpO=1517 conn=32 myRSS=2255 php=13 phpRSS=1444 ap=50 tcp=43 topuser=customc 2026-08-15 04:25:34 L1=6.19 run=2 blk=0 avail=6927 (59.1%) swpO=0 conn=7 myRSS=2255 php=1 phpRSS=78 ap=46 tcp=28 topuser=tubesupplies 2026-08-15 04:25:40 L1=5.86 run=3 blk=0 avail=6910 (58.9%) swpO=0 conn=32 myRSS=2255 php=1 phpRSS=114 ap=42 tcp=31 topuser=customc 2026-08-15 04:25:44 L1=6.03 run=4 blk=0 avail=6936 (59.1%) swpO=0 conn=7 myRSS=2255 php=2 phpRSS=125 ap=41 tcp=26 topuser=tubesupplies 2026-08-15 04:25:50 L1=5.71 run=3 blk=0 avail=6853 (58.4%) swpO=0 conn=32 myRSS=2255 php=1 phpRSS=133 ap=38 tcp=28 topuser=tubesupplies 2026-08-15 04:25:54 L1=5.33 run=3 blk=0 avail=7012 (59.8%) swpO=0 conn=7 myRSS=2255 php=1 phpRSS=64 ap=34 tcp=22 topuser=tubesupplies 2026-08-15 04:26:00 L1=4.98 run=1 blk=0 avail=7085 (60.4%) swpO=0 conn=32 myRSS=2255 php=0 phpRSS=0 ap=28 tcp=26 topuser=-