INCIDENT 2026-08-28 01:29:01 trigger: php_rss=2068MB ================================================================== load: 1.89 0.83 0.89 7/709 300113 ncpu:10 mem_avail: 6424MB/13777MB (46.6%) swap_used:2586MB swapout:896/s blocked(D):0 running:15 iowait:0.1% steal:0.0% php: 13 procs / 2068MB heaviest user: madalice (10 procs, 1929MB) apache: 53 procs tcp_estab: 55 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2857 madalice 10 1892 root 252 951 nobody 52 870 netdata 8 264 cpanellogin 1 102 evolution 5 71 mailman 20 47 dovenull 6 44 infinium 3 42 kurri 3 35 wp-toolkit 6 19 dovecot 3 18 aaa 1 15 lowrange 1 14 zabbix 1 13 nscd 1 6 named 1 5 mailnull 2 5 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1900 root 2 70 evolution 1 68 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5638 MB Active(file): 3004 MB Inactive(file): 2780 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 617 MB CommitLimit: 10984 MB Committed_AS: 9448 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 246634 root 17:44 10024 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2362432 1 mysql 2926456 15.4 Ssl 2-21:57:45 /usr/sbin/mariadbd 299551 3787359 madalice 255008 25.4 R 00:31 php-fpm: pool madalice_com_au 299552 3787359 madalice 250992 26.1 R 00:31 php-fpm: pool madalice_com_au 299550 3787359 madalice 237312 30.3 S 00:31 php-fpm: pool madalice_com_au 1220 1 netdata 210320 2.5 Ssl 59-15:19:11 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 299958 3787359 madalice 195332 70.4 R 00:09 php-fpm: pool madalice_com_au 299548 3787359 madalice 163148 28.8 S 00:31 php-fpm: pool madalice_com_au 299549 3787359 madalice 163064 27.6 S 00:31 php-fpm: pool madalice_com_au 299367 3787359 madalice 162784 24.2 S 00:37 php-fpm: pool madalice_com_au 299607 3787359 madalice 160124 26.4 S 00:30 php-fpm: pool madalice_com_au 299980 3787359 madalice 159844 47.5 S 00:08 php-fpm: pool madalice_com_au 299981 3787359 madalice 158912 48.8 S 00:08 php-fpm: pool madalice_com_au 2575382 1 root 146952 0.0 Ss 12-17:38:32 /usr/lib/systemd/systemd-journald 141899 3797563 root 146136 0.0 S 46:05 spamd child 3846467 3797563 root 128796 0.0 S 22:53:27 spamd child 2805458 1353308 cpanellogin 105000 0.0 S 08:09:33 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 3797563 1 root 78732 0.0 Ss 23:06:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 4180059 4180015 evolution 70292 0.0 Ss 01:29:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 2223 1201 root 41944 0.0 Sl 59-15:19:10 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3066250 1 root 37632 0.0 Ss 06:57:36 php-fpm: master process (/opt/cpanel/ea-php82/root/etc/php-fpm.conf) 3787359 1 root 34492 0.0 Ss 03:24:58 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4922 2431 netdata 34040 0.1 Sl 59-15:19:06 /usr/libexec/netdata/plugins.d/go.d.plugin 1 4180253 1 root 32748 0.0 Ss 01:28:59 lfd - sleeping 1353308 1 root 27380 0.0 Ss 36-22:47:41 cpsrvd (SSL) - waiting for connections 300058 1469 root 24736 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 294583 3066150 nobody 23204 0.2 S 03:53 /usr/sbin/httpd -k start 266021 3066150 nobody 21356 0.0 S 10:44 /usr/sbin/httpd -k start 294590 3066150 nobody 21288 0.0 S 03:53 /usr/sbin/httpd -k start 296259 3066150 nobody 21192 0.0 S 03:52 /usr/sbin/httpd -k start 299653 3066150 nobody 20280 0.1 S 00:27 /usr/sbin/httpd -k start 299643 3066150 nobody 20100 0.1 S 00:28 /usr/sbin/httpd -k start 292979 3066150 nobody 19992 0.0 S 03:54 /usr/sbin/httpd -k start 299657 3066150 nobody 19964 0.1 S 00:27 /usr/sbin/httpd -k start 1469 1 root 19632 0.1 Ss 59-15:19:10 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 185104 2431 netdata 19556 2.1 Sl 15-04:55:29 /usr/libexec/netdata/plugins.d/apps.plugin 1 299654 3066150 nobody 19468 0.1 S 00:27 /usr/sbin/httpd -k start 299613 3066150 nobody 19336 0.2 S 00:30 /usr/sbin/httpd -k start 299978 3066150 nobody 19052 0.2 S 00:08 /usr/sbin/httpd -k start 291415 3066150 nobody 18996 0.0 S 03:55 /usr/sbin/httpd -k start 299970 3066150 nobody 18972 0.2 S 00:08 /usr/sbin/httpd -k start 299969 3066150 nobody 18968 0.2 S 00:08 /usr/sbin/httpd -k start 299971 3066150 nobody 18928 0.1 S 00:08 /usr/sbin/httpd -k start 299972 3066150 nobody 18928 0.1 S 00:08 /usr/sbin/httpd -k start 299973 3066150 nobody 18928 0.1 S 00:08 /usr/sbin/httpd -k start 299975 3066150 nobody 18928 0.1 S 00:08 /usr/sbin/httpd -k start 299641 3066150 nobody 18900 0.0 S 00:28 /usr/sbin/httpd -k start 299642 3066150 nobody 18900 0.0 S 00:28 /usr/sbin/httpd -k start 299644 3066150 nobody 18828 0.1 S 00:28 /usr/sbin/httpd -k start 299974 3066150 nobody 18716 0.1 S 00:08 /usr/sbin/httpd -k start 300032 3066150 nobody 18464 0.0 R 00:03 /usr/sbin/httpd -k start 299425 3066150 nobody 18212 0.0 S 00:36 /usr/sbin/httpd -k start 299931 3066150 nobody 17820 0.1 R 00:10 /usr/sbin/httpd -k start 299955 3066150 nobody 17744 0.1 S 00:09 /usr/sbin/httpd -k start 299954 3066150 nobody 17740 0.1 S 00:09 /usr/sbin/httpd -k start 299951 3066150 nobody 17720 0.0 S 00:09 /usr/sbin/httpd -k start 299952 3066150 nobody 17676 0.0 S 00:09 /usr/sbin/httpd -k start 299953 3066150 nobody 17660 0.0 S 00:09 /usr/sbin/httpd -k start 299950 3066150 nobody 17656 0.0 S 00:09 /usr/sbin/httpd -k start 299956 3066150 nobody 17564 0.1 R 00:09 /usr/sbin/httpd -k start 299968 3066150 nobody 17168 0.2 S 00:08 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 528 D - [jbd2/sda2-8] 743 D'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min tubesupplies/tubesupplies.com.au-ssl_log 138 kamcool/kamcool.com.au 130 alison/alisonarts.com.au-ssl_log 87 candyfabcom/candyfab.com.au-ssl_log 44 madalice/madalice.com.au-ssl_log 37 evolution/portal.evolutionerp.com.au-ssl_log 20 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 130 20.48.147.90 104 74.248.24.12 85 20.104.18.15 44 52.139.44.162 31 54.216.128.149 30 158.158.54.35 20 203.54.180.238 3 118.127.40.55 2 43.165.65.117 2 114.119.159.70 1 40.77.167.32 1 2800:440:9c78:2500:8922:2953:98ab:2d20 1 190.239.194.127 1 158.23.184.117 1 114.119.140.234 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 6 GET / 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /sf.php 3 GET /num.php 3 GET /new.php 3 GET /admin.php 3 GET /7.php 2 POST /wp-cron.php 2 GET /zoom1.php 2 GET /ws37.php 2 GET /wp-content/uploads/min.php 2 GET /wp-content/plugins/index.php 2 GET /wp-content/plugins/beteng88/ws83.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-content/min.php 2 GET /wp-admin/maint/index.php 2 GET /wp-admin/js/widgets/ 2 GET /wp-admin/css/colors/blue/ --- busiest 3 vhosts: top paths + last 10 requests --- == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 GET / 2 POST /wp-cron.php 2 GET /zoom1.php 2 GET /ws37.php 2 GET /wp-content/uploads/min.php 2 GET /wp-content/plugins/beteng88/ws83.php 2 GET /wp-content/plugins/admin.php 2 GET /wp-content/min.php 2 GET /wp-admin/maint/index.php 2 GET /wp-admin/js/widgets/ 2 GET /wp-admin/css/colors/blue/ 2 GET /wp-admin/css/ -- last 10 requests -- 158.158.54.35 - - [28/Aug/2026:01:28:26 +1000] "GET /wp-content/min.php HTTP/1.1" 404 24978 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:28 +1000] "GET /wp-content/plugins/beteng88/ws83.php HTTP/1.1" 404 24967 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/ 158.158.54.35 - - [28/Aug/2026:01:28:30 +1000] "GET /ws37.php HTTP/1.1" 404 24971 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:32 +1000] "GET /assets/ HTTP/1.1" 404 24980 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:34 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:35 +1000] "GET /wp-admin/js/widgets/ HTTP/1.1" 200 519 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:35 +1000] "GET /il.php HTTP/1.1" 404 24971 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:37 +1000] "GET /images/index.php HTTP/1.1" 301 1 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:38 +1000] "GET /lite.php HTTP/1.1" 404 24967 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 158.158.54.35 - - [28/Aug/2026:01:28:40 +1000] "GET /load.php HTTP/1.1" 404 24971 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" == kamcool/kamcool.com.au == -- top paths -- 1 GET /zeal.php 1 GET /ynz.PhP7 1 GET /xwpg.php 1 GET /wuasr.php 1 GET /wso.php 1 GET /ws61.php 1 GET /ws60.php 1 GET /wp-su.php 1 GET /wp-sing.php 1 GET /wp-p2r3q9c8k4.php 1 GET /wplogbak.php 1 GET /wp-includes/Text/network.php -- last 10 requests -- 20.48.147.90 - - [28/Aug/2026:01:28:36 +1000] "GET /bless24.php HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:36 +1000] "GET /wp-includes/Text/Diff/index.php HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:37 +1000] "GET /wp-includes/css/dist/block-library/alfa-rex.php8 HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:37 +1000] "GET /wp-content/themes/twentytwenty/404.php HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:37 +1000] "GET /waf.php HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:37 +1000] "GET /autoload_classmap/sallu.php HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:37 +1000] "GET //shell20211028.php HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:38 +1000] "GET /wp-content/languages/chosen.php HTTP/1.1" 404 - "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:38 +1000] "GET /.well-known/acme-challenge/bak.php HTTP/1.1" 403 12 "-" "-" 20.48.147.90 - - [28/Aug/2026:01:28:38 +1000] "GET /C1.php HTTP/1.1" 404 - "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 POST / 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET /wnnjpsby.php 1 GET /w3lls.php -- last 10 requests -- 20.104.18.15 - - [28/Aug/2026:01:28:40 +1000] "GET /sym.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:40 +1000] "GET /8.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:41 +1000] "GET /goods.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:41 +1000] "GET /ah.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:42 +1000] "GET /ws55.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:42 +1000] "GET /drykl.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:43 +1000] "GET /backup.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:43 +1000] "GET /indo.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:44 +1000] "GET /sign.php HTTP/1.1" 401 36 "-" "-" 20.104.18.15 - - [28/Aug/2026:01:28:44 +1000] "GET /wnnjpsby.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 01:26:40 L1=0.50 run=1 blk=0 avail=8349 (60.6%) swpO=0 conn=3 myRSS=2871 php=5 phpRSS=316 ap=15 tcp=27 topuser=madalice 2026-08-28 01:26:40 L1=0.50 run=3 blk=0 avail=8348 (60.6%) swpO=0 conn=3 myRSS=2871 php=5 phpRSS=316 ap=15 tcp=27 topuser=madalice 2026-08-28 01:26:50 L1=0.42 run=2 blk=0 avail=8459 (61.4%) swpO=0 conn=3 myRSS=2871 php=4 phpRSS=182 ap=14 tcp=27 topuser=evolution 2026-08-28 01:26:50 L1=0.42 run=3 blk=0 avail=8459 (61.4%) swpO=0 conn=3 myRSS=2871 php=4 phpRSS=182 ap=14 tcp=27 topuser=evolution 2026-08-28 01:27:00 L1=0.36 run=3 blk=0 avail=8313 (60.3%) swpO=0 conn=3 myRSS=2871 php=6 phpRSS=382 ap=14 tcp=29 topuser=alison 2026-08-28 01:27:00 L1=0.36 run=3 blk=0 avail=8312 (60.3%) swpO=0 conn=3 myRSS=2871 php=6 phpRSS=384 ap=14 tcp=29 topuser=alison 2026-08-28 01:27:10 L1=0.30 run=3 blk=0 avail=8339 (60.5%) swpO=0 conn=3 myRSS=2871 php=5 phpRSS=316 ap=14 tcp=28 topuser=madalice 2026-08-28 01:27:11 L1=0.30 run=3 blk=0 avail=8338 (60.5%) swpO=0 conn=3 myRSS=2871 php=5 phpRSS=316 ap=14 tcp=28 topuser=madalice 2026-08-28 01:27:21 L1=0.26 run=2 blk=0 avail=8335 (60.5%) swpO=0 conn=3 myRSS=2871 php=5 phpRSS=315 ap=15 tcp=26 topuser=madalice 2026-08-28 01:27:21 L1=0.26 run=2 blk=0 avail=8335 (60.5%) swpO=0 conn=3 myRSS=2871 php=5 phpRSS=315 ap=15 tcp=26 topuser=madalice 2026-08-28 01:27:31 L1=0.22 run=1 blk=0 avail=8453 (61.4%) swpO=0 conn=3 myRSS=2871 php=4 phpRSS=182 ap=15 tcp=25 topuser=evolution 2026-08-28 01:27:31 L1=0.22 run=2 blk=0 avail=8453 (61.4%) swpO=0 conn=3 myRSS=2871 php=4 phpRSS=182 ap=15 tcp=25 topuser=evolution 2026-08-28 01:27:41 L1=0.18 run=1 blk=0 avail=8451 (61.3%) swpO=0 conn=3 myRSS=2871 php=4 phpRSS=182 ap=15 tcp=26 topuser=evolution 2026-08-28 01:27:41 L1=0.18 run=2 blk=0 avail=8450 (61.3%) swpO=0 conn=3 myRSS=2871 php=4 phpRSS=182 ap=15 tcp=26 topuser=evolution 2026-08-28 01:27:51 L1=0.15 run=2 blk=0 avail=8192 (59.5%) swpO=0 conn=3 myRSS=2876 php=6 phpRSS=471 ap=15 tcp=30 topuser=madalice 2026-08-28 01:27:51 L1=0.15 run=2 blk=0 avail=8192 (59.5%) swpO=0 conn=3 myRSS=2876 php=6 phpRSS=471 ap=15 tcp=30 topuser=madalice 2026-08-28 01:28:01 L1=0.21 run=4 blk=0 avail=8188 (59.4%) swpO=0 conn=3 myRSS=2876 php=7 phpRSS=513 ap=16 tcp=29 topuser=madalice 2026-08-28 01:28:01 L1=0.21 run=3 blk=0 avail=8187 (59.4%) swpO=0 conn=3 myRSS=2876 php=7 phpRSS=515 ap=16 tcp=29 topuser=madalice 2026-08-28 01:28:11 L1=0.26 run=4 blk=0 avail=8450 (61.3%) swpO=0 conn=3 myRSS=2876 php=3 phpRSS=141 ap=16 tcp=32 topuser=root 2026-08-28 01:28:11 L1=0.26 run=3 blk=0 avail=8445 (61.3%) swpO=0 conn=3 myRSS=2876 php=3 phpRSS=141 ap=16 tcp=30 topuser=root 2026-08-28 01:28:21 L1=0.22 run=6 blk=0 avail=8357 (60.7%) swpO=0 conn=3 myRSS=2876 php=4 phpRSS=269 ap=16 tcp=30 topuser=tubesupplies 2026-08-28 01:28:21 L1=0.22 run=4 blk=0 avail=8354 (60.6%) swpO=0 conn=3 myRSS=2876 php=4 phpRSS=270 ap=16 tcp=30 topuser=tubesupplies 2026-08-28 01:28:31 L1=0.41 run=11 blk=0 avail=7929 (57.6%) swpO=0 conn=3 myRSS=2876 php=10 phpRSS=724 ap=17 tcp=39 topuser=madalice 2026-08-28 01:28:31 L1=0.41 run=10 blk=0 avail=7931 (57.6%) swpO=0 conn=9 myRSS=2876 php=10 phpRSS=715 ap=17 tcp=37 topuser=madalice 2026-08-28 01:28:41 L1=0.88 run=2 blk=0 avail=7350 (53.4%) swpO=136 conn=3 myRSS=2876 php=11 phpRSS=1334 ap=29 tcp=36 topuser=madalice 2026-08-28 01:28:41 L1=0.88 run=3 blk=0 avail=7346 (53.3%) swpO=136 conn=9 myRSS=2876 php=11 phpRSS=1336 ap=29 tcp=36 topuser=madalice 2026-08-28 01:28:51 L1=0.82 run=2 blk=0 avail=7352 (53.4%) swpO=0 conn=3 myRSS=2876 php=11 phpRSS=1378 ap=24 tcp=50 topuser=madalice 2026-08-28 01:28:51 L1=0.82 run=4 blk=0 avail=7349 (53.3%) swpO=0 conn=9 myRSS=2876 php=11 phpRSS=1379 ap=24 tcp=50 topuser=madalice 2026-08-28 01:29:01 L1=1.89 run=15 blk=0 avail=6424 (46.6%) swpO=896 conn=8 myRSS=2857 php=13 phpRSS=2068 ap=53 tcp=55 topuser=madalice 2026-08-28 01:29:01 L1=1.89 run=15 blk=0 avail=6409 (46.5%) swpO=896 conn=7 myRSS=2857 php=13 phpRSS=2008 ap=53 tcp=55 topuser=madalice