INCIDENT 2026-08-15 07:25:17 trigger: php_rss=1588MB ================================================================== load: 15.62 19.14 15.37 12/622 2562337 ncpu:10 mem_avail: 8273MB/11729MB (70.5%) swap_used:1576MB swapout:0/s blocked(D):0 running:12 iowait:4.2% steal:0.0% php: 11 procs / 1588MB heaviest user: madalice (6 procs, 1068MB) apache: 48 procs tcp_estab: 46 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 5 852 nobody 47 628 mysql 1 473 corpkicks 2 347 root 242 280 netdata 8 198 tubesupplies 2 117 alison 1 75 wp-toolkit 6 17 mailman 20 17 vinesit 1 12 dovenull 6 11 zabbix 1 10 mailnull 2 9 dovecot 3 6 cpanellogin 1 6 dbus 1 3 evolution 4 2 polkitd 1 1 nscd 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 5 861 corpkicks 2 349 tubesupplies 2 118 alison 1 76 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 2071 MB Active(file): 937 MB Inactive(file): 715 MB Dirty: 1 MB Writeback: 0 MB SReclaimable: 159 MB CommitLimit: 9960 MB Committed_AS: 8644 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 06:14:02 120 /usr/bin/imunify-agent-proxy 2561985 root 00:16 1228 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2561012 1 mysql 484688 4.5 Ssl 01:47 /usr/sbin/mariadbd 2562276 2559822 madalice 263984 73.6 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2562194 2562134 corpkicks 243072 15.4 S 00:10 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2562284 2562271 madalice 230600 66.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2562286 2562239 madalice 181236 78.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 150936 2.5 Ssl 46-21:15:20 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2562304 2562281 corpkicks 126588 46.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2562298 2562158 madalice 125836 99.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2562299 2562279 madalice 107920 78.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2562306 2559959 alison 82896 47.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 66184 0.0 Ss 05:02:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2562305 2562160 tubesupplies 62916 27.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2562303 2560365 tubesupplies 62880 29.0 D 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 62304 0.0 S 04:49:40 spamd child 4922 2431 netdata 35264 0.1 Sl 46-21:15:15 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2562365 1469 root 21964 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 20064 0.0 Ss 24-04:43:50 cpsrvd (SSL) - waiting for connections 2560348 1276780 nobody 18368 0.0 S 02:43 /usr/sbin/httpd -k start 2562151 1276780 nobody 18024 0.1 S 00:12 /usr/sbin/httpd -k start 2562157 1276780 nobody 17980 0.2 S 00:11 /usr/sbin/httpd -k start 2562150 1276780 nobody 17924 0.1 S 00:12 /usr/sbin/httpd -k start 2562160 1276780 nobody 17824 0.0 S 00:11 /usr/sbin/httpd -k start 2560547 1276780 nobody 17476 0.3 S 02:23 /usr/sbin/httpd -k start 2562241 1276780 nobody 17088 0.1 S 00:07 /usr/sbin/httpd -k start 2562158 1276780 nobody 17084 0.1 S 00:11 /usr/sbin/httpd -k start 2562233 1276780 nobody 16892 0.1 S 00:08 /usr/sbin/httpd -k start 2562240 1276780 nobody 16888 0.0 S 00:07 /usr/sbin/httpd -k start 2560365 1276780 nobody 16876 0.0 S 02:42 /usr/sbin/httpd -k start 2562258 1276780 nobody 16852 0.0 S 00:05 /usr/sbin/httpd -k start 2562282 1276780 nobody 16824 0.0 S 00:03 /usr/sbin/httpd -k start 2562234 1276780 nobody 16780 0.1 S 00:08 /usr/sbin/httpd -k start 2562242 1276780 nobody 16264 0.0 S 00:07 /usr/sbin/httpd -k start 2562199 1276780 nobody 16192 0.1 S 00:09 /usr/sbin/httpd -k start 2562272 1276780 nobody 15696 0.0 S 00:04 /usr/sbin/httpd -k start 2562239 1276780 nobody 15632 0.0 S 00:07 /usr/sbin/httpd -k start 185104 2431 netdata 15408 2.0 Sl 2-10:51:38 /usr/libexec/netdata/plugins.d/apps.plugin 1 2562271 1276780 nobody 14924 0.0 S 00:04 /usr/sbin/httpd -k start 2562134 1276780 nobody 14908 0.0 S 00:13 /usr/sbin/httpd -k start 2562279 1276780 nobody 14860 0.0 S 00:03 /usr/sbin/httpd -k start 2562281 1276780 nobody 14692 0.0 S 00:03 /usr/sbin/httpd -k start 159820 1 root 14440 0.0 Ss 25-21:38:28 /usr/lib/systemd/systemd-journald 2559961 1276780 nobody 14224 0.0 S 03:00 /usr/sbin/httpd -k start 2559752 1276780 nobody 14168 0.0 S 03:06 /usr/sbin/httpd -k start 2559739 1276780 nobody 13892 0.0 S 03:07 /usr/sbin/httpd -k start 2562159 1276780 nobody 13716 0.0 S 00:11 /usr/sbin/httpd -k start 2562280 1276780 nobody 13704 0.0 S 00:03 /usr/sbin/httpd -k start 2559955 1276780 nobody 13548 0.0 S 03:00 /usr/sbin/httpd -k start 2559958 1276780 nobody 13480 0.0 S 03:00 /usr/sbin/httpd -k start 2559755 1276780 nobody 13428 0.0 S 03:06 /usr/sbin/httpd -k start 2559822 1276780 nobody 13104 0.0 S 03:01 /usr/sbin/httpd -k start 2223 1201 root 12780 0.0 Sl 46-21:15:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2562308 3828812 vinesit 12724 0.0 S 00:01 dovecot/imap 2559695 1276780 nobody 12720 0.0 S 03:09 /usr/sbin/httpd -k start 2560144 1276780 nobody 11984 0.0 S 02:54 /usr/sbin/httpd -k start 2559701 1276780 nobody 11708 0.4 S 03:08 /usr/sbin/httpd -k start 2561701 1471 root 11620 0.0 S 00:51 cPhulkd - processor - http socket 2560102 1276780 nobody 11312 0.0 S 02:57 /usr/sbin/httpd -k start 2562289 1276780 nobody 10784 0.0 S 00:02 /usr/sbin/httpd -k start 2562290 1276780 nobody 10784 0.0 S 00:02 /usr/sbin/httpd -k start 2562291 1276780 nobody 10784 0.0 S 00:02 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 2562303 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2562305 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 226 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-----+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au-ssl_log 88 alison/alisonarts.com.au 41 alison/alisonarts.com.au-ssl_log 41 madalice/madalice.com.au-ssl_log 22 evolution/portal.evolutionerp.com.au-ssl_log 18 aaa/aaadownunder.com.au-ssl_log 1 corpkicks/corporatekicks.com.au-ssl_log 1 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 88 172.213.18.162 80 20.127.131.12 18 203.54.180.238 2 223.109.252.176 2 17.246.23.30 2 149.90.170.175 2 113.168.254.3 1 81.17.136.224 1 66.249.65.171 1 66.249.65.169 1 66.132.172.188 1 52.167.144.140 1 47.82.202.189 1 43.119.104.143 1 43.119.100.96 --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 8 GET / 4 POST / 3 GET /ws13.php 3 GET /wp-ws68.php 3 GET /55.php 2 GET /yj09.php 2 GET /xyn.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /sky.php 2 GET /SDsadqwrf.php 2 GET /scxy.php 2 GET /puc.php 2 GET /ops.php 2 GET /mgrr.php 2 GET /media.php 2 GET /mac.php 2 GET /inso.php 2 GET /img.php --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 1 GET /ww3.php 1 GET /ww1.php 1 GET /wunaivpl.php 1 GET /wuasr.php 1 GET /wto.php 1 GET /wtiiy.php 1 GET /wta.php 1 GET /wso-x569.php 1 GET /wsax.php 1 GET /wsa.php 1 GET /wsad.php 1 GET /ws88.php -- last 10 requests -- 172.213.18.162 - - [15/Aug/2026:07:24:22 +1000] "GET /wsad.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:23 +1000] "GET /wsax.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:24 +1000] "GET /wso-x569.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:24 +1000] "GET /wta.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:25 +1000] "GET /wtiiy.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:26 +1000] "GET /wto.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:26 +1000] "GET /wuasr.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:27 +1000] "GET /wunaivpl.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:27 +1000] "GET /ww1.php HTTP/1.1" 401 36 "-" "-" 172.213.18.162 - - [15/Aug/2026:07:24:28 +1000] "GET /ww3.php HTTP/1.1" 401 36 "-" "-" == alison/alisonarts.com.au == -- top paths -- 1 GET /yj09.php 1 GET /xyn.php 1 GET /ws13.php 1 GET /wp-ws68.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /sky.php 1 GET /SDsadqwrf.php 1 GET /scxy.php 1 GET /puc.php 1 GET /ops.php 1 GET //mosty.php -- last 10 requests -- 20.127.131.12 - - [15/Aug/2026:07:24:45 +1000] "GET /file5.php HTTP/1.1" 301 283 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:47 +1000] "GET /xyn.php HTTP/1.1" 301 281 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:49 +1000] "GET /4PJcpMFsD8B.php HTTP/1.1" 301 289 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:51 +1000] "GET /inso.php HTTP/1.1" 301 282 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:53 +1000] "GET /puc.php HTTP/1.1" 301 281 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:55 +1000] "GET /19.php HTTP/1.1" 301 280 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:57 +1000] "GET /133.php HTTP/1.1" 301 281 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:58 +1000] "GET /1xmomo.php HTTP/1.1" 301 284 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:25:00 +1000] "GET //mosty.php HTTP/1.1" 301 283 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:25:03 +1000] "GET /blurbs.php HTTP/1.1" 301 284 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /ws13.php 2 GET /wp-ws68.php 2 GET /55.php 1 GET /yj09.php 1 GET /xyn.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /this_is_a_new_hello_world.php 1 GET /sky.php 1 GET /SDsadqwrf.php 1 GET /scxy.php 1 GET /puc.php 1 GET /ops.php -- last 10 requests -- 20.127.131.12 - - [15/Aug/2026:07:24:39 +1000] "GET /3PJcpMFsD8B.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:41 +1000] "GET /BDKR28WP.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:43 +1000] "GET /sky.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:45 +1000] "GET /file5.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:47 +1000] "GET /xyn.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:49 +1000] "GET /4PJcpMFsD8B.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:51 +1000] "GET /inso.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:53 +1000] "GET /puc.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:55 +1000] "GET /19.php HTTP/1.1" 404 49207 "-" "-" 20.127.131.12 - - [15/Aug/2026:07:24:57 +1000] "GET /133.php HTTP/1.1" 404 49207 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 07:22:20 L1=4.32 run=33 blk=0 avail=6170 (52.6%) swpO=0 conn=26 myRSS=531 php=29 phpRSS=3992 ap=59 tcp=85 topuser=madalice 2026-08-15 07:22:29 L1=11.33 run=72 blk=0 avail=4010 (34.2%) swpO=0 conn=50 myRSS=541 php=54 phpRSS=6531 ap=80 tcp=90 topuser=madalice 2026-08-15 07:22:31 L1=11.33 run=60 blk=0 avail=3580 (30.5%) swpO=0 conn=53 myRSS=542 php=56 phpRSS=6977 ap=88 tcp=88 topuser=madalice 2026-08-15 07:22:40 L1=20.96 run=77 blk=0 avail=1697 (14.5%) swpO=39 conn=69 myRSS=549 php=68 phpRSS=9160 ap=102 tcp=65 topuser=madalice 2026-08-15 07:22:41 L1=20.96 run=77 blk=0 avail=1150 (9.8%) swpO=417 conn=68 myRSS=550 php=69 phpRSS=9784 ap=103 tcp=59 topuser=madalice 2026-08-15 07:22:51 L1=30.44 run=5 blk=85 avail=291 (2.5%) swpO=52201 conn=70 myRSS=493 php=71 phpRSS=9882 ap=100 tcp=41 topuser=madalice 2026-08-15 07:22:52 L1=30.44 run=69 blk=48 avail=300 (2.6%) swpO=48690 conn=70 myRSS=495 php=71 phpRSS=9905 ap=99 tcp=44 topuser=madalice 2026-08-15 07:23:16 L1=71.77 run=128 blk=110 avail=463 (4.0%) swpO=8373 conn=- myRSS=0 php=84 phpRSS=7263 ap=113 tcp=27 topuser=madalice 2026-08-15 07:23:22 L1=77.63 run=45 blk=22 avail=386 (3.3%) swpO=5711 conn=- myRSS=0 php=84 phpRSS=7456 ap=112 tcp=27 topuser=madalice 2026-08-15 07:23:36 L1=71.18 run=2 blk=1 avail=9551 (81.4%) swpO=3063 conn=3 myRSS=446 php=2 phpRSS=118 ap=98 tcp=23 topuser=alison 2026-08-15 07:23:38 L1=71.18 run=2 blk=2 avail=9494 (80.9%) swpO=3045 conn=2 myRSS=447 php=1 phpRSS=153 ap=96 tcp=29 topuser=alison 2026-08-15 07:23:46 L1=60.39 run=3 blk=0 avail=9505 (81.0%) swpO=0 conn=3 myRSS=448 php=2 phpRSS=160 ap=88 tcp=27 topuser=alison 2026-08-15 07:23:49 L1=60.39 run=2 blk=0 avail=9510 (81.1%) swpO=0 conn=2 myRSS=448 php=1 phpRSS=128 ap=86 tcp=28 topuser=alison 2026-08-15 07:23:57 L1=51.10 run=7 blk=1 avail=9429 (80.4%) swpO=0 conn=3 myRSS=449 php=4 phpRSS=250 ap=79 tcp=33 topuser=aaa 2026-08-15 07:23:59 L1=51.10 run=3 blk=0 avail=9515 (81.1%) swpO=0 conn=2 myRSS=449 php=1 phpRSS=64 ap=76 tcp=32 topuser=alison 2026-08-15 07:24:07 L1=43.47 run=1 blk=0 avail=9563 (81.5%) swpO=0 conn=1 myRSS=450 php=1 phpRSS=40 ap=68 tcp=24 topuser=evolution 2026-08-15 07:24:09 L1=43.47 run=1 blk=0 avail=9583 (81.7%) swpO=0 conn=1 myRSS=451 php=0 phpRSS=0 ap=65 tcp=25 topuser=- 2026-08-15 07:24:17 L1=36.95 run=2 blk=0 avail=9483 (80.8%) swpO=0 conn=1 myRSS=452 php=1 phpRSS=129 ap=58 tcp=23 topuser=madalice 2026-08-15 07:24:19 L1=36.95 run=2 blk=0 avail=9550 (81.4%) swpO=0 conn=1 myRSS=453 php=1 phpRSS=68 ap=55 tcp=21 topuser=alison 2026-08-15 07:24:27 L1=31.42 run=4 blk=1 avail=9517 (81.1%) swpO=0 conn=1 myRSS=454 php=1 phpRSS=133 ap=47 tcp=22 topuser=alison 2026-08-15 07:24:29 L1=31.42 run=2 blk=0 avail=9519 (81.2%) swpO=0 conn=1 myRSS=454 php=1 phpRSS=142 ap=45 tcp=19 topuser=alison 2026-08-15 07:24:37 L1=26.67 run=1 blk=1 avail=9672 (82.5%) swpO=0 conn=1 myRSS=455 php=0 phpRSS=0 ap=37 tcp=22 topuser=- 2026-08-15 07:24:39 L1=26.67 run=1 blk=0 avail=9685 (82.6%) swpO=0 conn=1 myRSS=455 php=0 phpRSS=0 ap=35 tcp=20 topuser=- 2026-08-15 07:24:47 L1=22.80 run=1 blk=1 avail=9707 (82.8%) swpO=0 conn=1 myRSS=457 php=0 phpRSS=0 ap=27 tcp=17 topuser=- 2026-08-15 07:24:49 L1=22.80 run=1 blk=0 avail=9723 (82.9%) swpO=0 conn=1 myRSS=457 php=0 phpRSS=0 ap=25 tcp=16 topuser=- 2026-08-15 07:24:57 L1=19.45 run=2 blk=0 avail=9743 (83.1%) swpO=0 conn=1 myRSS=457 php=1 phpRSS=47 ap=19 tcp=21 topuser=alison 2026-08-15 07:24:59 L1=19.45 run=4 blk=0 avail=9725 (82.9%) swpO=0 conn=1 myRSS=457 php=1 phpRSS=58 ap=19 tcp=18 topuser=alison 2026-08-15 07:25:07 L1=16.53 run=2 blk=0 avail=9686 (82.6%) swpO=0 conn=1 myRSS=458 php=1 phpRSS=61 ap=26 tcp=26 topuser=alison 2026-08-15 07:25:09 L1=16.53 run=7 blk=1 avail=9256 (78.9%) swpO=0 conn=6 myRSS=462 php=6 phpRSS=622 ap=27 tcp=30 topuser=madalice 2026-08-15 07:25:17 L1=15.62 run=12 blk=0 avail=8273 (70.5%) swpO=0 conn=12 myRSS=473 php=11 phpRSS=1588 ap=48 tcp=46 topuser=madalice