INCIDENT 2026-09-02 07:16:06 trigger: php_rss=1658MB ================================================================== load: 2.77 2.36 1.97 3/645 1693935 ncpu:10 mem_avail: 6248MB/13777MB (45.4%) swap_used:2290MB swapout:0/s blocked(D):0 running:3 iowait:0.0% steal:0.0% php: 13 procs / 1658MB heaviest user: madalice (10 procs, 1585MB) apache: 28 procs tcp_estab: 41 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 3325 madalice 10 1585 root 246 1083 nobody 27 519 mailman 20 354 cpanellogin 1 240 netdata 7 204 dovenull 6 67 evolution 8 63 wp-toolkit 3 59 lowrange 4 58 kurri 2 29 dovecot 3 28 zabbix 1 19 mailnull 2 16 named 1 12 nscd 1 4 cpanelconnecttrack 1 4 polkitd 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1585 evolution 2 47 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4653 MB Active(file): 4225 MB Inactive(file): 725 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 489 MB CommitLimit: 10984 MB Committed_AS: 8626 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1675064 root 05:31 58084 /opt/imunify360/venv/bin/python3 -m imav.run 3926885 root 1-04:53:37 4736 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 3404824 10.4 Ssl 5-04:56:57 /usr/sbin/mariadbd 704828 1353308 cpanellogin 246340 0.1 S 04:40:11 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale server_locale en default_login_theme cpanel 706070 655564 root 189668 0.0 S 04:38:07 spamd child 508924 1 netdata 183348 2.0 Ssl 5-04:56:26 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 706071 655564 root 181664 0.0 S 04:38:07 spamd child 655564 1 root 174396 0.0 Rs 04:52:43 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1635808 3929444 madalice 164764 4.8 S 15:37 php-fpm: pool madalice_com_au 1635856 3929444 madalice 164552 5.5 R 15:36 php-fpm: pool madalice_com_au 1637876 3929444 madalice 164060 5.1 S 13:13 php-fpm: pool madalice_com_au 1658344 3929444 madalice 163924 7.0 S 07:31 php-fpm: pool madalice_com_au 1635880 3929444 madalice 162220 4.6 S 15:30 php-fpm: pool madalice_com_au 1635978 3929444 madalice 162076 5.0 S 15:17 php-fpm: pool madalice_com_au 1638804 3929444 madalice 161600 6.3 S 11:46 php-fpm: pool madalice_com_au 1635875 3929444 madalice 161296 5.4 S 15:31 php-fpm: pool madalice_com_au 1635858 3929444 madalice 161168 4.4 S 15:35 php-fpm: pool madalice_com_au 1677864 3929444 madalice 159580 5.0 S 02:47 php-fpm: pool madalice_com_au 1675064 1 root 58084 0.4 Ssl 05:31 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 47852 0.0 Sl 5-04:56:23 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1693896 1659125 evolution 40444 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 1353308 1 root 37724 0.1 Ss 42-04:34:49 cpsrvd (SSL) - waiting for connections 3929420 1 wp-toolkit 37420 0.0 Ss 1-04:53:28 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 654927 1 root 33244 0.0 Ss 04:53:14 lfd - sleeping 1469 1 root 33196 0.1 Ss 64-21:06:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1693901 1463 root 27812 0.0 S 00:00 tailwatchd - chkservd - spamd check 3929444 1 root 26148 0.0 Ss 1-04:53:28 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 1677190 506832 nobody 24400 0.0 S 03:24 /usr/sbin/httpd -k start 1675593 506832 nobody 24248 0.0 S 05:05 /usr/sbin/httpd -k start 1463 1 root 24012 0.0 Ss 64-21:06:18 tailwatchd 1659448 506832 nobody 23928 0.1 S 06:40 /usr/sbin/httpd -k start 1659125 506832 nobody 23912 0.1 S 06:50 /usr/sbin/httpd -k start 1676552 506832 nobody 23160 0.0 S 04:13 /usr/sbin/httpd -k start 1693601 506832 nobody 22328 0.2 S 00:30 /usr/sbin/httpd -k start 1693744 506832 nobody 22168 0.2 S 00:18 /usr/sbin/httpd -k start 1682587 506832 nobody 22076 0.0 S 01:01 /usr/sbin/httpd -k start 1678310 506832 nobody 21632 0.1 S 01:58 /usr/sbin/httpd -k start 1693747 506832 nobody 21604 0.1 S 00:18 /usr/sbin/httpd -k start 1677932 506832 nobody 21384 0.0 S 02:36 /usr/sbin/httpd -k start 1678493 506832 nobody 21372 0.0 S 01:47 /usr/sbin/httpd -k start 3929564 1 wp-toolkit 20888 0.0 Ss 1-04:53:27 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1693754 506832 nobody 20768 0.1 S 00:17 /usr/sbin/httpd -k start 1693714 506832 nobody 20548 0.0 S 00:19 /usr/sbin/httpd -k start 1693713 506832 nobody 20500 0.0 S 00:19 /usr/sbin/httpd -k start 1693593 506832 nobody 20492 0.0 S 00:34 /usr/sbin/httpd -k start 483898 1 zabbix 20316 0.2 Ssl 5-04:57:40 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1693594 506832 nobody 20272 0.0 S 00:34 /usr/sbin/httpd -k start 1678282 506832 nobody 19996 0.0 S 02:00 /usr/sbin/httpd -k start 1693753 506832 nobody 19804 0.1 S 00:17 /usr/sbin/httpd -k start 1693755 506832 nobody 19648 0.0 S 00:17 /usr/sbin/httpd -k start 654684 654679 mailman 19380 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s 654690 654679 mailman 19368 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s 654699 654679 mailman 19348 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s 654685 654679 mailman 19320 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s 654693 654679 mailman 19200 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s 654687 654679 mailman 19176 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s 654692 654679 mailman 19092 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s 654689 654679 mailman 19048 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 654686 654679 mailman 19032 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s 654698 654679 mailman 19016 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 654696 654679 mailman 18948 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s 654700 654679 mailman 18944 0.0 S 04:53:23 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 15916078 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min bigdeals/bigdeals.com.au-ssl_log 261 evolution/my.evolutionerp.com.au-ssl_log 211 madalice/madalice.com.au-ssl_log 129 olympic/olympicfencing.com.au-ssl_log 124 evolution/app.evolutionerp.com.au-ssl_log 98 evolution/portal.evolutionerp.com.au-ssl_log 29 tubesupplies/tubesupplies.com.au-ssl_log 3 aaa/aaadownunder.com.au-ssl_log 2 corpkicks/corporatekicks.com.au-ssl_log 2 infinium/infinium.net.au-ssl_log 2 olympic/olympicfencing.com.au 1 otterfencing/otterfencing.com.au-ssl_log 1 (total vhosts taking traffic: 12) --- top client IPs across all vhosts (last 3 min) --- 261 34.17.115.140 122 149.88.19.85 115 4.204.224.164 98 203.54.180.238 59 40.115.94.245 46 150.228.151.47 39 34.151.229.54 39 103.104.165.99 34 103.104.164.114 6 182.239.240.254 6 136.111.191.51 6 118.127.40.55 4 1.145.38.38 3 52.167.144.209 3 1.145.118.159 --- top request paths across all vhosts (last 3 min) --- 65 POST /functions.php 26 GET /app/ajax.php 25 GET /index.php 25 GET /heartbeat.php 14 POST /plugins/csvexporter/plugin.php 13 GET / 9 POST /app/ajax/selectFilterSingle.php 8 POST / 7 POST //functions.php 7 POST /app/ajax/selectFilter.php 6 POST /wp-cron.php 6 POST /clienteditsave.php 6 GET /store/af1-richmond9/ 6 GET //app/ajax.php 5 POST /app/ajax.php 4 POST /wp-login.php 4 POST /jobeditsave.php 4 POST /inveditsave.php 4 GET /robots.txt 3 GET /products/security-and-industrial-fencing --- busiest 3 vhosts: top paths + last 10 requests --- == bigdeals/bigdeals.com.au-ssl_log == -- top paths -- 4 POST / 1 GET /zend/.env 1 GET /yii/.env 1 GET /www/phpinfo.php 1 GET /www/.env 1 GET /wp/.env 1 GET /wp-admin/phpinfo.php 1 GET /worker/.env 1 GET /wordpress/.env 1 GET /webroot/index.php/_environment 1 GET /webmail/phpinfo.php 1 GET /web/.env -- last 10 requests -- 34.17.115.140 - - [02/Sep/2026:07:15:17 +1000] "GET /preview/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:17 +1000] "GET /www/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:17 +1000] "GET /htdocs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:17 +1000] "GET /public_html/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:18 +1000] "GET /site/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:18 +1000] "GET /docs/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:18 +1000] "GET /wp-admin/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:18 +1000] "GET /administrator/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:19 +1000] "GET /core/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" 34.17.115.140 - - [02/Sep/2026:07:15:19 +1000] "GET /includes/phpinfo.php HTTP/1.1" 403 12 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 65 POST /functions.php 26 GET /app/ajax.php 24 GET /index.php 14 POST /plugins/csvexporter/plugin.php 9 POST /app/ajax/selectFilterSingle.php 9 GET / 7 POST //functions.php 7 POST /app/ajax/selectFilter.php 6 POST /clienteditsave.php 6 GET //app/ajax.php 5 POST /app/ajax.php 4 POST /jobeditsave.php -- last 10 requests -- 103.104.165.99 - - [02/Sep/2026:07:16:02 +1000] "GET /app/ajax.php?cn=&furi=true&uri=page%3Dquotereg&call=getUserSetting&caller=ajaxSubmitLocal&seq=14331934785 HTTP/1.1" 200 160 "https://my.evolutionerp.com.au/index.php? 103.104.165.99 - - [02/Sep/2026:07:16:03 +1000] "POST //functions.php?call=heartbeat HTTP/1.1" 200 235 "https://my.evolutionerp.com.au//index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. 103.104.165.99 - - [02/Sep/2026:07:16:02 +1000] "POST /quoteditsave.php?call=getTheQuotes HTTP/1.1" 200 11314 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi 103.104.165.99 - - [02/Sep/2026:07:16:03 +1000] "POST /functions.php?call=heartbeat HTTP/1.1" 200 232 "https://my.evolutionerp.com.au/index.php?page=quotereg" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 182.239.240.254 - - [02/Sep/2026:07:16:03 +1000] "POST /login.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safa 182.239.240.254 - - [02/Sep/2026:07:16:03 +1000] "GET / HTTP/1.1" 200 34088 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537. 182.239.240.254 - - [02/Sep/2026:07:16:05 +1000] "POST /login2save.php HTTP/1.1" 302 20 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 182.239.240.254 - - [02/Sep/2026:07:16:05 +1000] "GET / HTTP/1.1" 200 18288 "https://my.evolutionerp.com.au/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537. 52.167.144.209 - - [02/Sep/2026:07:16:05 +1000] "GET /index.php?page=quotedit"eid=78690 HTTP/1.1" 200 5258 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot 52.167.144.209 - - [02/Sep/2026:07:16:05 +1000] "GET /index.php?page=quotedit"eid=78553§ionid=0 HTTP/1.1" 200 5269 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing == madalice/madalice.com.au-ssl_log == -- top paths -- 6 GET /store/af1-richmond9/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/wp-content/plugins/woocommerce/packages/email-editor/src/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations//wp-content/plugins/woocommerce/packages/email-editor/src/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core//wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer//wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks//wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons//wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/ 1 GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/telegram/wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/ -- last 10 requests -- 149.88.19.85 - - [02/Sep/2026:07:15:53 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/reddit/ HTTP/1.1" 200 362 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:15:53 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/reddit//wp-content/plugins/woocommerce/packages/email-editor/src/Integr 114.119.130.40 - - [02/Sep/2026:07:15:55 +1000] "GET /store/af1-richmond9/?image=1&verified=1&wcpr_rating=4 HTTP/1.1" 200 50063 "https://madalice.com.au/store/af1-richmond9/?image=1&verified=1&wcpr_rating=4" "Mozilla/5.0 149.88.19.85 - - [02/Sep/2026:07:15:55 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/reddit/wp-content/plugins/woocommerce/packages/email-editor/src/Integra 149.88.19.85 - - [02/Sep/2026:07:15:57 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/spotify/ HTTP/1.1" 200 363 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:15:57 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/spotify//wp-content/plugins/woocommerce/packages/email-editor/src/Integ 149.88.19.85 - - [02/Sep/2026:07:15:58 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/spotify/wp-content/plugins/woocommerce/packages/email-editor/src/Integr 149.88.19.85 - - [02/Sep/2026:07:16:00 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/telegram/ HTTP/1.1" 200 363 "-" "-" 149.88.19.85 - - [02/Sep/2026:07:16:01 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/telegram//wp-content/plugins/woocommerce/packages/email-editor/src/Inte 149.88.19.85 - - [02/Sep/2026:07:16:02 +1000] "GET /wp-content/plugins/woocommerce/packages/email-editor/src/Integrations/Core/Renderer/Blocks/icons/telegram/wp-content/plugins/woocommerce/packages/email-editor/src/Integ --- last 30 samples (run-up to this incident) --- 2026-09-02 07:13:35 L1=1.48 run=3 blk=0 avail=6459 (46.9%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1512 ap=21 tcp=31 topuser=madalice 2026-09-02 07:13:45 L1=1.49 run=2 blk=0 avail=6275 (45.6%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1695 ap=21 tcp=30 topuser=madalice 2026-09-02 07:13:45 L1=1.49 run=2 blk=0 avail=6257 (45.4%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1715 ap=21 tcp=30 topuser=madalice 2026-09-02 07:13:55 L1=1.41 run=3 blk=0 avail=6528 (47.4%) swpO=0 conn=3 myRSS=3324 php=14 phpRSS=1451 ap=22 tcp=28 topuser=madalice 2026-09-02 07:13:55 L1=1.41 run=1 blk=0 avail=6555 (47.6%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1411 ap=22 tcp=28 topuser=madalice 2026-09-02 07:14:05 L1=1.35 run=4 blk=0 avail=6922 (50.2%) swpO=0 conn=3 myRSS=3324 php=15 phpRSS=1109 ap=21 tcp=34 topuser=madalice 2026-09-02 07:14:05 L1=1.35 run=5 blk=0 avail=6896 (50.1%) swpO=0 conn=3 myRSS=3324 php=15 phpRSS=1132 ap=22 tcp=35 topuser=madalice 2026-09-02 07:14:15 L1=1.45 run=3 blk=0 avail=7115 (51.6%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=787 ap=27 tcp=35 topuser=madalice 2026-09-02 07:14:15 L1=1.45 run=2 blk=0 avail=7132 (51.8%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=787 ap=27 tcp=35 topuser=madalice 2026-09-02 07:14:25 L1=1.54 run=4 blk=0 avail=6590 (47.8%) swpO=0 conn=2 myRSS=3324 php=15 phpRSS=1343 ap=32 tcp=55 topuser=madalice 2026-09-02 07:14:25 L1=1.54 run=4 blk=0 avail=6570 (47.7%) swpO=0 conn=3 myRSS=3324 php=15 phpRSS=1358 ap=33 tcp=55 topuser=madalice 2026-09-02 07:14:35 L1=1.61 run=3 blk=0 avail=6627 (48.1%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=1276 ap=29 tcp=34 topuser=madalice 2026-09-02 07:14:35 L1=1.61 run=1 blk=0 avail=6629 (48.1%) swpO=0 conn=3 myRSS=3324 php=13 phpRSS=1276 ap=29 tcp=34 topuser=madalice 2026-09-02 07:14:45 L1=1.66 run=1 blk=0 avail=7038 (51.1%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=907 ap=23 tcp=38 topuser=madalice 2026-09-02 07:14:45 L1=1.66 run=4 blk=0 avail=7018 (50.9%) swpO=0 conn=2 myRSS=3324 php=13 phpRSS=907 ap=23 tcp=38 topuser=madalice 2026-09-02 07:14:55 L1=1.86 run=3 blk=0 avail=6903 (50.1%) swpO=0 conn=2 myRSS=3324 php=15 phpRSS=1113 ap=22 tcp=33 topuser=madalice 2026-09-02 07:14:55 L1=1.86 run=5 blk=0 avail=6865 (49.8%) swpO=0 conn=2 myRSS=3324 php=15 phpRSS=1138 ap=22 tcp=33 topuser=madalice 2026-09-02 07:15:05 L1=2.67 run=4 blk=0 avail=6284 (45.6%) swpO=0 conn=6 myRSS=3325 php=17 phpRSS=1750 ap=25 tcp=34 topuser=madalice 2026-09-02 07:15:05 L1=2.67 run=6 blk=0 avail=6226 (45.2%) swpO=0 conn=6 myRSS=3325 php=17 phpRSS=1836 ap=25 tcp=34 topuser=madalice 2026-09-02 07:15:15 L1=2.80 run=1 blk=0 avail=6327 (45.9%) swpO=0 conn=3 myRSS=3325 php=14 phpRSS=1671 ap=20 tcp=33 topuser=madalice 2026-09-02 07:15:16 L1=2.80 run=3 blk=0 avail=6284 (45.6%) swpO=0 conn=3 myRSS=3325 php=15 phpRSS=1754 ap=20 tcp=32 topuser=madalice 2026-09-02 07:15:25 L1=3.16 run=2 blk=0 avail=6322 (45.9%) swpO=0 conn=3 myRSS=3325 php=13 phpRSS=1655 ap=20 tcp=29 topuser=madalice 2026-09-02 07:15:26 L1=3.16 run=1 blk=0 avail=6331 (46.0%) swpO=0 conn=1 myRSS=3325 php=12 phpRSS=1617 ap=20 tcp=29 topuser=madalice 2026-09-02 07:15:35 L1=3.14 run=1 blk=0 avail=6299 (45.7%) swpO=1 conn=2 myRSS=3324 php=13 phpRSS=1658 ap=24 tcp=34 topuser=madalice 2026-09-02 07:15:36 L1=3.14 run=2 blk=0 avail=6302 (45.7%) swpO=1 conn=2 myRSS=3324 php=12 phpRSS=1626 ap=24 tcp=32 topuser=madalice 2026-09-02 07:15:45 L1=3.04 run=1 blk=0 avail=6319 (45.9%) swpO=0 conn=1 myRSS=3325 php=12 phpRSS=1617 ap=22 tcp=45 topuser=madalice 2026-09-02 07:15:46 L1=3.04 run=1 blk=0 avail=6304 (45.8%) swpO=0 conn=1 myRSS=3325 php=12 phpRSS=1617 ap=24 tcp=46 topuser=madalice 2026-09-02 07:15:56 L1=3.10 run=4 blk=0 avail=6164 (44.7%) swpO=0 conn=4 myRSS=3325 php=13 phpRSS=1744 ap=31 tcp=37 topuser=madalice 2026-09-02 07:15:56 L1=3.10 run=1 blk=0 avail=6261 (45.4%) swpO=0 conn=1 myRSS=3325 php=12 phpRSS=1616 ap=31 tcp=37 topuser=madalice 2026-09-02 07:16:06 L1=2.77 run=3 blk=0 avail=6248 (45.4%) swpO=0 conn=3 myRSS=3325 php=13 phpRSS=1658 ap=28 tcp=41 topuser=madalice