INCIDENT 2026-09-01 03:22:41 trigger: php_rss=1588MB ================================================================== load: 5.29 2.37 1.43 12/658 4133936 ncpu:10 mem_avail: 6776MB/13777MB (49.2%) swap_used:2223MB swapout:0/s blocked(D):0 running:11 iowait:0.0% steal:0.0% php: 11 procs / 1588MB heaviest user: madalice (7 procs, 1313MB) apache: 24 procs tcp_estab: 36 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3360 madalice 7 1337 root 254 1164 nobody 23 410 netdata 7 212 wp-toolkit 3 132 customc 1 124 speedlin 1 118 cpanellogin 1 72 mailman 20 67 dovenull 6 46 lowrange 2 29 evolution 7 29 mailnull 2 26 kurri 2 26 zabbix 1 18 dovecot 3 18 aaa 1 15 infinium 1 14 kamcool 1 13 --- php workers by user --- USER PROCS RSS_MB madalice 7 1252 customc 1 127 speedlin 1 119 root 1 34 evolution 1 10 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5732 MB Active(file): 4072 MB Inactive(file): 1911 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 687 MB CommitLimit: 10984 MB Committed_AS: 8133 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3926885 root 01:00:12 6768 /usr/bin/imunify-agent-proxy 4051771 root 22:41 1340 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3440784 9.1 Ssl 4-01:03:32 /usr/sbin/mariadbd 4133019 3929444 madalice 250116 62.0 R 01:24 php-fpm: pool madalice_com_au 4133397 3929444 madalice 225856 59.4 R 00:55 php-fpm: pool madalice_com_au 508924 1 netdata 191132 1.9 Ssl 4-01:03:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3963221 3930335 root 185592 0.0 S 52:24 spamd child 4132418 3929444 madalice 180548 56.7 R 02:18 php-fpm: pool madalice_com_au 3930335 1 root 175620 0.1 Ss 59:30 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 3963222 3930335 root 168164 0.0 S 52:24 spamd child 4126134 3929444 madalice 165356 57.2 R 02:34 php-fpm: pool madalice_com_au 4133012 3929444 madalice 161332 61.1 R 01:25 php-fpm: pool madalice_com_au 4118098 3929444 madalice 161296 47.4 S 03:13 php-fpm: pool madalice_com_au 4133880 3929444 madalice 160744 64.2 S 00:04 php-fpm: pool madalice_com_au 4133896 4132495 customc 139296 53.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 4133895 4118170 speedlin 128068 97.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509266 1 root 94716 0.0 Ss 4-01:02:58 /usr/lib/systemd/systemd-journald 3929420 1 wp-toolkit 76340 0.0 Ss 01:00:03 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 509640 508992 root 75568 0.0 Sl 4-01:02:56 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 3501614 1353308 cpanellogin 74280 0.0 S 03:04:45 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 509236 509098 root 61004 0.0 Sl 4-01:02:58 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 3929564 1 wp-toolkit 49312 0.0 Ss 01:00:02 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1353308 1 root 41780 0.1 Ss 41-00:41:24 cpsrvd (SSL) - waiting for connections 3929469 1 root 39160 0.0 Ss 01:00:03 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) 3929532 1 root 36008 0.0 Ss 01:00:02 lfd - sleeping 3929444 1 root 35204 0.0 Ss 01:00:03 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4133902 3929532 root 33236 0.0 S 00:00 lfd - checking system integrity 4111236 506832 nobody 23324 0.2 S 07:33 /usr/sbin/httpd -k start 4117076 506832 nobody 22988 0.1 S 05:05 /usr/sbin/httpd -k start 4109632 506832 nobody 22536 0.1 S 07:34 /usr/sbin/httpd -k start 4118169 506832 nobody 22444 0.3 S 03:02 /usr/sbin/httpd -k start 1469 1 root 22104 0.1 Ss 63-17:12:53 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4112854 506832 nobody 22080 0.2 S 07:32 /usr/sbin/httpd -k start 4118170 506832 nobody 20432 0.0 S 03:02 /usr/sbin/httpd -k start 4133024 506832 nobody 20412 0.0 S 01:24 /usr/sbin/httpd -k start 4132464 506832 nobody 20368 0.4 S 02:11 /usr/sbin/httpd -k start 4133025 506832 nobody 20008 0.2 S 01:24 /usr/sbin/httpd -k start 1463 1 root 19680 0.0 Ss 63-17:12:53 tailwatchd 4133067 506832 nobody 19656 0.1 S 01:21 /usr/sbin/httpd -k start 4133014 506832 nobody 19544 0.0 S 01:25 /usr/sbin/httpd -k start 483898 1 zabbix 19444 0.2 Ssl 4-01:04:15 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 4133406 506832 nobody 19404 0.0 S 00:54 /usr/sbin/httpd -k start 4133443 506832 nobody 19304 0.0 S 00:51 /usr/sbin/httpd -k start 4133068 506832 nobody 19060 0.0 S 01:21 /usr/sbin/httpd -k start 4133414 506832 nobody 19052 0.0 S 00:52 /usr/sbin/httpd -k start 4133037 506832 nobody 18556 0.1 S 01:22 /usr/sbin/httpd -k start 4132497 506832 nobody 18312 0.0 S 02:09 /usr/sbin/httpd -k start 4132495 506832 nobody 17756 0.1 S 02:09 /usr/sbin/httpd -k start 4133889 506832 nobody 16588 0.0 S 00:02 /usr/sbin/httpd -k start 4083104 1471 root 16572 0.0 S 15:59 cPhulkd - dbprocessor 509671 508992 netdata 16364 2.1 Sl 4-01:02:56 /usr/libexec/netdata/plugins.d/apps.plugin 1 4133885 506832 nobody 15880 0.0 S 00:03 /usr/sbin/httpd -k start 3252945 508511 aaa 15872 0.0 S 04:17:52 dovecot/imap 4133890 506832 nobody 15868 0.0 S 00:02 /usr/sbin/httpd -k start 1471 1 root 15500 0.0 Ss 63-17:12:53 cPhulkd - processor 3098283 508511 lowrange 15352 0.0 S 05:05:44 dovecot/imap 4101396 1471 root 15096 0.0 S 08:12 cPhulkd - processor - http socket 2977131 508511 lowrange 15068 0.0 S 05:41:31 dovecot/imap 4032782 508511 infinium 14804 0.0 S 31:22 dovecot/imap 508720 1 mailnull 14788 0.0 Ss 4-01:03:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 4133872 508511 kurri 14584 0.0 S 00:06 dovecot/imap 4133634 508511 kamcool 13684 0.0 S 00:33 dovecot/quota-status -p postfix --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+-------------+-------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+-------------+-------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 10086103 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 10086095 | madalice_wp | madalice_wp | Query | 0 | Opening tables | SELECT SQL_CALC_FOUND_ROWS AMuqf6qZ_posts.ID FROM AMuqf6qZ_posts WHERE 1=1 AND AMuqf6qZ_posts.post_title = '404' AND AMuqf6qZ_posts.post_type = 'wp_block' AND ((AMuqf6qZ_posts.post_status = 'publish')) ORDER BY AMuqf6qZ_posts.post_date DESC LIMIT 0, 1 | +----------+-------------+-------------+---------+------+----------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 348 evolution/app.evolutionerp.com.au-ssl_log 97 kamcool/kamcool.com.au 93 evolution/evolutionerp.com.au-ssl_log 51 customc/customcentral.com.au 44 olytis/tis.com.au-ssl_log 44 customc/customcentral.com.au-ssl_log 36 evolution/portal.evolutionerp.com.au-ssl_log 28 corpkicks/corporatekicks.com.au-ssl_log 6 infinium/infinium.net.au-ssl_log 2 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 314 4.204.224.164 97 40.115.94.245 93 20.220.227.7 75 68.155.159.216 44 20.151.200.44 44 158.23.18.78 28 203.54.180.238 26 52.73.200.34 5 118.127.40.55 3 114.119.140.234 2 203.55.131.3 2 129.121.65.255 2 114.119.145.239 2 108.167.161.148 2 102.134.101.35 --- top request paths across all vhosts (last 3 min) --- 94 GET /api/getItem/LWFB2001KG 28 GET /heartbeat.php 10 GET /wp-content/plugins/hellopress/wp_filemanager.php 10 GET /this_is_a_new_hello_world.php 10 GET /moon.php 7 GET /classwithtostring.php 7 GET /adminfuns.php 7 GET /1.php 6 GET /wp-login.php 6 GET /media.php 6 GET /3PJcpMFsD8B.php 5 POST /wp-cron.php 5 GET /xamp.php 5 GET /wp-content/themes/foter.php 5 GET /wp-content/languages/foter.php 5 GET /ssg.php 5 GET /sm.php 5 GET /silver.php 5 GET /nail.php 5 GET /m.php --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 10 GET /moon.php 5 GET /xamp.php 5 GET /wp-content/themes/foter.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /wp-content/languages/foter.php 5 GET /this_is_a_new_hello_world.php 5 GET /ssg.php 5 GET /sm.php 5 GET /silver.php 5 GET /nail.php 5 GET /media.php 5 GET /file-gertdxz.php -- last 10 requests -- 4.204.224.164 - - [01/Sep/2026:03:22:31 +1000] "GET /classwithtostring.php?p= HTTP/1.1" 403 13 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:30 +1000] "GET /4PJcpMFsD8B.php HTTP/1.1" 404 36648 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:30 +1000] "GET /wsd.php HTTP/1.1" 404 36639 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:31 +1000] "GET /new.php HTTP/1.1" 403 13 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:30 +1000] "GET /ws55.php?p= HTTP/1.1" 301 1 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:31 +1000] "GET /3PJcpMFsD8B.php HTTP/1.1" 404 36646 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:32 +1000] "GET /wsd.php HTTP/1.1" 404 36638 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:32 +1000] "GET /vpn.php HTTP/1.1" 404 36638 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:32 +1000] "GET /ws55.php HTTP/1.1" 404 36639 "-" "-" 4.204.224.164 - - [01/Sep/2026:03:22:32 +1000] "GET /bulet.php HTTP/1.1" 404 36640 "-" "-" == evolution/app.evolutionerp.com.au-ssl_log == -- top paths -- 94 GET /api/getItem/LWFB2001KG 3 GET /api/getItem/LWPB2001KG -- last 10 requests -- 40.115.94.245 - - [01/Sep/2026:03:21:33 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:33 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:34 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:34 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:35 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:35 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:35 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:36 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:36 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" 40.115.94.245 - - [01/Sep/2026:03:21:37 +1000] "GET /api/getItem/LWFB2001KG HTTP/1.1" 200 1309 "-" "RestSharp/106.13.0.0" == kamcool/kamcool.com.au == -- top paths -- 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET //un.php 1 GET /this_is_a_new_hello_world.php 1 GET /tesla1.php 1 GET /t7cyZd.php 1 GET /swm.php 1 GET /ss.php 1 GET /sid3.php 1 GET /shop.php 1 GET /shiny.php 1 GET /send.php 1 GET /search.php -- last 10 requests -- 20.220.227.7 - - [01/Sep/2026:03:22:05 +1000] "GET /alfanew2.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:05 +1000] "GET /ss.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /mariju.php HTTP/1.1" 403 13 "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /metamers.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET //11.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /kct403.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:06 +1000] "GET /fox.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:07 +1000] "GET /f7.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:07 +1000] "GET /bypass.php HTTP/1.1" 404 - "-" "-" 20.220.227.7 - - [01/Sep/2026:03:22:07 +1000] "GET /nti.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-09-01 03:20:12 L1=1.04 run=1 blk=0 avail=7874 (57.2%) swpO=0 conn=1 myRSS=3360 php=4 phpRSS=356 ap=19 tcp=31 topuser=madalice 2026-09-01 03:20:20 L1=1.04 run=3 blk=0 avail=7858 (57.0%) swpO=0 conn=2 myRSS=3360 php=4 phpRSS=378 ap=19 tcp=29 topuser=madalice 2026-09-01 03:20:22 L1=1.04 run=2 blk=0 avail=7827 (56.8%) swpO=0 conn=2 myRSS=3360 php=4 phpRSS=403 ap=19 tcp=28 topuser=madalice 2026-09-01 03:20:30 L1=1.18 run=5 blk=0 avail=7740 (56.2%) swpO=0 conn=2 myRSS=3360 php=5 phpRSS=520 ap=18 tcp=36 topuser=madalice 2026-09-01 03:20:33 L1=1.18 run=4 blk=0 avail=7605 (55.2%) swpO=0 conn=2 myRSS=3360 php=5 phpRSS=543 ap=21 tcp=38 topuser=madalice 2026-09-01 03:20:40 L1=1.38 run=4 blk=0 avail=7620 (55.3%) swpO=0 conn=4 myRSS=3360 php=6 phpRSS=638 ap=22 tcp=31 topuser=madalice 2026-09-01 03:20:43 L1=1.38 run=3 blk=0 avail=7604 (55.2%) swpO=0 conn=2 myRSS=3360 php=6 phpRSS=661 ap=22 tcp=25 topuser=madalice 2026-09-01 03:20:50 L1=1.48 run=4 blk=0 avail=7664 (55.6%) swpO=1 conn=4 myRSS=3360 php=5 phpRSS=518 ap=17 tcp=28 topuser=madalice 2026-09-01 03:20:53 L1=1.48 run=3 blk=0 avail=7732 (56.1%) swpO=1 conn=2 myRSS=3360 php=5 phpRSS=543 ap=17 tcp=27 topuser=madalice 2026-09-01 03:21:00 L1=1.40 run=4 blk=0 avail=7664 (55.6%) swpO=2 conn=4 myRSS=3360 php=5 phpRSS=604 ap=17 tcp=29 topuser=madalice 2026-09-01 03:21:03 L1=1.40 run=5 blk=0 avail=7677 (55.7%) swpO=2 conn=2 myRSS=3360 php=5 phpRSS=585 ap=17 tcp=30 topuser=madalice 2026-09-01 03:21:10 L1=1.73 run=4 blk=0 avail=7499 (54.4%) swpO=0 conn=4 myRSS=3360 php=6 phpRSS=788 ap=17 tcp=30 topuser=madalice 2026-09-01 03:21:13 L1=1.73 run=3 blk=0 avail=7522 (54.6%) swpO=0 conn=2 myRSS=3360 php=7 phpRSS=799 ap=17 tcp=31 topuser=madalice 2026-09-01 03:21:20 L1=2.23 run=6 blk=0 avail=7326 (53.2%) swpO=0 conn=4 myRSS=3360 php=7 phpRSS=942 ap=21 tcp=36 topuser=madalice 2026-09-01 03:21:23 L1=2.23 run=5 blk=0 avail=7250 (52.6%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=1041 ap=23 tcp=38 topuser=madalice 2026-09-01 03:21:31 L1=3.03 run=6 blk=0 avail=7282 (52.9%) swpO=0 conn=4 myRSS=3360 php=7 phpRSS=984 ap=23 tcp=36 topuser=madalice 2026-09-01 03:21:33 L1=3.03 run=5 blk=0 avail=7318 (53.1%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=974 ap=23 tcp=38 topuser=madalice 2026-09-01 03:21:41 L1=3.56 run=6 blk=0 avail=7180 (52.1%) swpO=0 conn=6 myRSS=3360 php=10 phpRSS=1151 ap=24 tcp=38 topuser=madalice 2026-09-01 03:21:43 L1=3.56 run=9 blk=0 avail=7138 (51.8%) swpO=0 conn=5 myRSS=3360 php=10 phpRSS=1209 ap=24 tcp=39 topuser=madalice 2026-09-01 03:21:51 L1=4.24 run=9 blk=0 avail=6905 (50.1%) swpO=0 conn=6 myRSS=3360 php=11 phpRSS=1450 ap=26 tcp=43 topuser=madalice 2026-09-01 03:21:53 L1=4.24 run=5 blk=0 avail=7171 (52.1%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=986 ap=28 tcp=34 topuser=madalice 2026-09-01 03:22:01 L1=4.74 run=5 blk=0 avail=7130 (51.8%) swpO=0 conn=6 myRSS=3360 php=9 phpRSS=1167 ap=25 tcp=33 topuser=madalice 2026-09-01 03:22:03 L1=4.74 run=5 blk=0 avail=7239 (52.5%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=1029 ap=25 tcp=33 topuser=madalice 2026-09-01 03:22:11 L1=4.93 run=11 blk=0 avail=6991 (50.7%) swpO=2 conn=6 myRSS=3360 php=10 phpRSS=1299 ap=25 tcp=34 topuser=madalice 2026-09-01 03:22:13 L1=4.93 run=8 blk=0 avail=6989 (50.7%) swpO=2 conn=5 myRSS=3360 php=9 phpRSS=1266 ap=25 tcp=32 topuser=madalice 2026-09-01 03:22:21 L1=5.02 run=6 blk=0 avail=7160 (52.0%) swpO=0 conn=6 myRSS=3360 php=9 phpRSS=1163 ap=22 tcp=30 topuser=madalice 2026-09-01 03:22:23 L1=5.02 run=5 blk=0 avail=7207 (52.3%) swpO=0 conn=5 myRSS=3360 php=8 phpRSS=1076 ap=22 tcp=29 topuser=madalice 2026-09-01 03:22:31 L1=5.26 run=9 blk=0 avail=7115 (51.6%) swpO=0 conn=6 myRSS=3360 php=9 phpRSS=1236 ap=21 tcp=33 topuser=madalice 2026-09-01 03:22:33 L1=5.26 run=3 blk=0 avail=7155 (51.9%) swpO=0 conn=5 myRSS=3360 php=9 phpRSS=1169 ap=21 tcp=31 topuser=madalice 2026-09-01 03:22:41 L1=5.29 run=11 blk=0 avail=6776 (49.2%) swpO=0 conn=8 myRSS=3360 php=11 phpRSS=1588 ap=24 tcp=36 topuser=madalice