INCIDENT 2026-08-25 23:08:26 trigger: php_rss=1827MB ================================================================== load: 0.14 0.54 0.85 15/609 2282587 ncpu:10 mem_avail: 5817MB/11729MB (49.6%) swap_used:1340MB swapout:881/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 12 procs / 1827MB heaviest user: madalice (12 procs, 1827MB) apache: 22 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2304 madalice 11 1477 root 236 776 nobody 21 349 netdata 8 250 cpanellogin 1 93 dovenull 6 46 kurri 3 37 infinium 2 28 mailman 20 22 wp-toolkit 6 18 dovecot 3 17 lowrange 1 14 zabbix 1 13 candyfabcom 1 13 mailnull 2 9 named 1 6 evolution 4 6 nscd 1 5 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 11 1485 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5805 MB Active(file): 2520 MB Inactive(file): 2684 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 430 MB CommitLimit: 9960 MB Committed_AS: 8237 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1913717 root 21:57:09 2672 /usr/bin/imunify-agent-proxy 2251510 root 08:26 3028 /bin/sh -c bash -c "sleep $((RANDOM % 1800))" ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2359516 16.9 Ssl 19:37:09 /usr/sbin/mariadbd 2282535 2251203 madalice 272184 83.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2282541 2234587 madalice 271416 96.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2282543 2282542 madalice 268044 119 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 193412 2.5 Ssl 57-12:58:35 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 83438 2145741 root 177672 0.1 S 10:34:26 spamd child 2575382 1 root 151216 0.0 Ss 10-15:17:56 /usr/lib/systemd/systemd-journald 2160755 2145741 root 142844 0.0 S 20:43:02 spamd child 2282547 2282545 madalice 104884 97.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2282546 2282544 madalice 104532 93.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 656359 1353308 cpanellogin 95948 0.0 S 08:00:17 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2282560 2282552 madalice 79908 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2282556 2282551 madalice 71496 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2282555 2282554 madalice 61124 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2282558 2282553 madalice 60784 0.0 S 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2145741 1 root 50212 0.0 Ss 20:45:24 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2223 1201 root 44300 0.0 Sl 57-12:58:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 4922 2431 netdata 37352 0.1 Sl 57-12:58:30 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 35228 0.1 Ss 57-12:58:34 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 23688 0.0 Ss 34-20:27:05 cpsrvd (SSL) - waiting for connections 2265302 1276780 nobody 22520 0.0 S 07:51 /usr/sbin/httpd -k start 2234587 1276780 nobody 21916 0.0 S 13:34 /usr/sbin/httpd -k start 2266078 1276780 nobody 21476 0.0 S 06:00 /usr/sbin/httpd -k start 2281259 1276780 nobody 21244 0.0 S 02:46 /usr/sbin/httpd -k start 2281686 1276780 nobody 20188 0.0 S 02:05 /usr/sbin/httpd -k start 2281258 1276780 nobody 20008 0.0 S 02:46 /usr/sbin/httpd -k start 2281705 1276780 nobody 19972 0.0 S 02:02 /usr/sbin/httpd -k start 2281248 1276780 nobody 19740 0.0 S 02:47 /usr/sbin/httpd -k start 2251203 1276780 nobody 18936 0.0 S 08:59 /usr/sbin/httpd -k start 2281268 1276780 nobody 18920 0.0 S 02:45 /usr/sbin/httpd -k start 2281678 1276780 nobody 18876 0.0 S 02:06 /usr/sbin/httpd -k start 2251078 1276780 nobody 18648 0.0 S 09:16 /usr/sbin/httpd -k start 185104 2431 netdata 18456 2.1 Rl 13-02:34:53 /usr/libexec/netdata/plugins.d/apps.plugin 1 2265998 1471 root 16676 0.0 S 06:10 cPhulkd - dbprocessor 2282542 1276780 nobody 15892 0.0 S 00:02 /usr/sbin/httpd -k start 2282553 1276780 nobody 15888 0.0 S 00:00 /usr/sbin/httpd -k start 2282545 1276780 nobody 15828 2.0 S 00:01 /usr/sbin/httpd -k start 2282551 1276780 nobody 15828 0.0 S 00:00 /usr/sbin/httpd -k start 2282552 1276780 nobody 15828 0.0 S 00:00 /usr/sbin/httpd -k start 2282554 1276780 nobody 15828 0.0 S 00:00 /usr/sbin/httpd -k start 2282544 1276780 nobody 15768 0.0 S 00:01 /usr/sbin/httpd -k start 1471 1 root 15676 0.0 Ss 57-12:58:34 cPhulkd - processor 1982516 3828812 kurri 15504 0.0 S 01:31:02 dovecot/imap 2183290 3828812 lowrange 15148 0.0 S 31:58 dovecot/imap 2266000 1471 root 15080 0.0 S 06:10 cPhulkd - processor - http socket 1204 1 zabbix 14916 0.2 Ssl 57-12:58:35 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2099930 3828812 infinium 14772 0.0 S 56:44 dovecot/imap 2216852 3828812 infinium 14648 0.0 S 20:53 dovecot/imap 2282530 3828812 kurri 14428 0.0 S 00:04 dovecot/imap 1463 1 root 14260 0.0 Ss 57-12:58:34 tailwatchd 2281871 3828812 candyfabcom 13540 0.0 S 01:43 dovecot/quota-status -p postfix 2265599 3828812 root 12964 0.0 S 07:12 dovecot/auth -w 2144580 1 root 11696 0.0 Ss 20:46:13 lfd - sleeping 1780156 3828812 dovenull 11304 0.0 S 22:35:35 dovecot/imap-login 1780152 3828812 dovenull 10620 0.0 S 22:35:35 dovecot/imap-login 1780159 3828812 dovenull 9424 0.0 S 22:35:35 dovecot/pop3-login 1780154 3828812 dovenull 9236 0.0 S 22:35:35 dovecot/pop3-login 1780162 3828812 dovecot 8972 0.0 S 22:35:35 dovecot/auth 1795692 3828812 kurri 8160 0.0 S 22:32:52 dovecot/imap 2107879 1 root 7636 0.0 Ss 6-20:45:48 queueprocd - waiting up to 60s to process a task --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4606865 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4606856 | madalice_wp | madalice_wp | Query | 0 | Creating sort index | SELECT post_id, meta_key, meta_value FROM AMuqf6qZ_postmeta WHERE post_id IN (30355,30215,24267,28038,28039,31435,27504,29650,31434,30358,30855,29710,33491,34411,30495,24095,24104,33648,28302,24099,30810,30812,30811,24101,24103,34413,31534,30494,29596,31153,31154,30813,31156,31155,31635,33533,33536, | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min lowrange/lowrange.com.au 228 nrg/nrgservices.net.au 93 nrg/nrgservices.net.au-ssl_log 93 evolution/release.evolutionerp.com.au 43 evolution/my.evolutionerp.com.au-ssl_log 34 kurri/kurrimotorinn.com.au-ssl_log 27 evolution/portal.evolutionerp.com.au-ssl_log 19 madalice/madalice.com.au-ssl_log 8 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 228 20.63.64.130 185 20.48.147.90 72 20.151.129.194 27 20.220.10.235 19 203.54.180.238 4 1.145.35.53 2 2403:5809:7747:0:758c:b39a:7bab:58f5 1 52.167.144.219 1 52.167.144.136 1 2a09:bac5:3a54:18be::277:44 1 146.70.192.110 1 114.119.146.16 1 114.119.143.14 1 114.119.140.234 1 114.119.131.88 --- top request paths across all vhosts (last 3 min) --- 19 GET /heartbeat.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /4PJcpMFsD8B.php 4 GET /1.php 3 GET /wpxml.php 3 GET /wp-css.php 3 GET /wp-content/themes/index.php 3 GET /wp-content/min.php 3 GET /wp-asudo.php 3 GET /wp-admin/maint/max.php 3 GET /wp6.php 3 GET /wp5.php 3 GET /wkl.php 3 GET /we.php 3 GET /v5.php 3 GET /v2.php 3 GET /usr.php 3 GET /tiny2.php 3 GET /read.php --- busiest 3 vhosts: top paths + last 10 requests --- == lowrange/lowrange.com.au == -- top paths -- 2 GET /Zoo.php 2 GET /zoo2.php 2 GET /z43agz.php 2 GET /yawa.php 2 GET /x1da.php 2 GET /wpxml.php 2 GET /wp-includes/Text/Diff/Engine/file_ed27.php 2 GET /wp-includes/Text/Diff/Engine/file_cdd9.php 2 GET /wp-fure.php 2 GET /wp-css.php 2 GET /wp-content/uploads/file1.php 2 GET /wp-content/themes/index.php -- last 10 requests -- 20.63.64.130 - - [25/Aug/2026:23:06:36 +1000] "GET /f35.update.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:36 +1000] "GET /sxxb.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:36 +1000] "GET /todo.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:37 +1000] "GET /ws77.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:37 +1000] "GET /wp-admin/css/index.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:37 +1000] "GET /load.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:37 +1000] "GET /fling.php?p= HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:37 +1000] "GET /privdayz.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:37 +1000] "GET /kj.php HTTP/1.1" 404 - "-" "-" 20.63.64.130 - - [25/Aug/2026:23:06:37 +1000] "GET /js.php HTTP/1.1" 404 - "-" "-" == nrg/nrgservices.net.au == -- top paths -- 1 GET /xxxx.php 1 GET /xxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x.php 1 GET /xeqdlun.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php 1 GET /ws38.php 1 GET /ws37.php -- last 10 requests -- 20.48.147.90 - - [25/Aug/2026:23:06:35 +1000] "GET /size.php HTTP/1.1" 301 283 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:35 +1000] "GET /error.php HTTP/1.1" 301 284 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:36 +1000] "GET /404.php HTTP/1.1" 301 282 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:36 +1000] "GET /file32.php HTTP/1.1" 301 285 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:37 +1000] "GET /lol.php HTTP/1.1" 301 282 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:37 +1000] "GET /haa.php HTTP/1.1" 301 282 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:37 +1000] "GET /333.php HTTP/1.1" 301 282 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:38 +1000] "GET /ws38.php HTTP/1.1" 301 283 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:38 +1000] "GET /xx.php HTTP/1.1" 301 281 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:39 +1000] "GET /klex.php HTTP/1.1" 301 283 "-" "-" == nrg/nrgservices.net.au-ssl_log == -- top paths -- 1 GET /xxxx.php 1 GET /xxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x.php 1 GET /xeqdlun.php 1 GET /x7.php 1 GET /wto.php 1 GET /wsd.php 1 GET /ws45.php 1 GET /ws38.php 1 GET /ws37.php -- last 10 requests -- 20.48.147.90 - - [25/Aug/2026:23:06:35 +1000] "GET /031.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:35 +1000] "GET /size.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:36 +1000] "GET /error.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:36 +1000] "GET /404.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:36 +1000] "GET /file32.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:37 +1000] "GET /lol.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:37 +1000] "GET /haa.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:38 +1000] "GET /333.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:38 +1000] "GET /ws38.php HTTP/1.1" 200 19 "-" "-" 20.48.147.90 - - [25/Aug/2026:23:06:39 +1000] "GET /xx.php HTTP/1.1" 200 19 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-25 23:05:59 L1=0.54 run=2 blk=0 avail=7123 (60.7%) swpO=0 conn=2 myRSS=2324 php=1 phpRSS=90 ap=19 tcp=25 topuser=madalice 2026-08-25 23:06:06 L1=0.49 run=1 blk=0 avail=7171 (61.1%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=18 tcp=27 topuser=- 2026-08-25 23:06:09 L1=0.53 run=2 blk=0 avail=7172 (61.1%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=18 tcp=26 topuser=- 2026-08-25 23:06:16 L1=0.49 run=1 blk=0 avail=7171 (61.1%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=18 tcp=26 topuser=- 2026-08-25 23:06:19 L1=0.45 run=1 blk=0 avail=7170 (61.1%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=18 tcp=27 topuser=- 2026-08-25 23:06:26 L1=0.50 run=4 blk=0 avail=7138 (60.9%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=22 tcp=34 topuser=- 2026-08-25 23:06:29 L1=0.46 run=1 blk=0 avail=7139 (60.9%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=22 tcp=28 topuser=- 2026-08-25 23:06:36 L1=0.42 run=7 blk=0 avail=7133 (60.8%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=22 tcp=30 topuser=- 2026-08-25 23:06:39 L1=0.39 run=2 blk=0 avail=7122 (60.7%) swpO=0 conn=2 myRSS=2324 php=1 phpRSS=52 ap=22 tcp=28 topuser=infinium 2026-08-25 23:06:46 L1=0.43 run=1 blk=0 avail=7153 (61.0%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=21 tcp=25 topuser=- 2026-08-25 23:06:49 L1=0.40 run=1 blk=0 avail=7166 (61.1%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=20 tcp=22 topuser=- 2026-08-25 23:06:56 L1=0.37 run=1 blk=0 avail=7188 (61.3%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=16 tcp=21 topuser=- 2026-08-25 23:06:59 L1=0.34 run=1 blk=0 avail=7194 (61.3%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-25 23:07:06 L1=0.31 run=1 blk=0 avail=7192 (61.3%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 23:07:09 L1=0.29 run=3 blk=0 avail=6834 (58.3%) swpO=2 conn=2 myRSS=2324 php=3 phpRSS=457 ap=15 tcp=26 topuser=corpkicks 2026-08-25 23:07:16 L1=0.26 run=2 blk=0 avail=7193 (61.3%) swpO=2 conn=1 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-25 23:07:19 L1=0.24 run=1 blk=0 avail=7193 (61.3%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=25 topuser=- 2026-08-25 23:07:26 L1=0.22 run=1 blk=0 avail=7189 (61.3%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-25 23:07:29 L1=0.20 run=1 blk=0 avail=7188 (61.3%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=24 topuser=- 2026-08-25 23:07:36 L1=0.19 run=2 blk=0 avail=7004 (59.7%) swpO=0 conn=1 myRSS=2324 php=1 phpRSS=137 ap=15 tcp=26 topuser=alison 2026-08-25 23:07:39 L1=0.17 run=4 blk=0 avail=6795 (57.9%) swpO=0 conn=2 myRSS=2324 php=2 phpRSS=270 ap=15 tcp=26 topuser=madalice 2026-08-25 23:07:46 L1=0.16 run=1 blk=0 avail=7182 (61.2%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 23:07:49 L1=0.14 run=1 blk=0 avail=7183 (61.2%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-25 23:07:56 L1=0.13 run=1 blk=0 avail=7183 (61.2%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 23:07:59 L1=0.12 run=1 blk=0 avail=7183 (61.2%) swpO=0 conn=2 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-25 23:08:06 L1=0.19 run=1 blk=1 avail=7184 (61.2%) swpO=0 conn=1 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=22 topuser=- 2026-08-25 23:08:09 L1=0.18 run=3 blk=0 avail=7016 (59.8%) swpO=1 conn=2 myRSS=2324 php=1 phpRSS=106 ap=15 tcp=25 topuser=madalice 2026-08-25 23:08:16 L1=0.16 run=1 blk=0 avail=7183 (61.2%) swpO=1 conn=1 myRSS=2324 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-25 23:08:19 L1=0.15 run=2 blk=0 avail=7100 (60.5%) swpO=2 conn=2 myRSS=2324 php=2 phpRSS=155 ap=15 tcp=25 topuser=madalice 2026-08-25 23:08:26 L1=0.14 run=15 blk=0 avail=5817 (49.6%) swpO=881 conn=9 myRSS=2304 php=12 phpRSS=1827 ap=22 tcp=40 topuser=madalice