Check for signs of compromise

What to look for

• PHP files you don't recognise, or recently changed files in your web root
• code with eval, base64_decode, gzinflate or shell functions in places where you don't expect it
• new cron jobs, system users, SSH keys or administrator accounts in your application
• PHP or web server processes that start sh, bash, curl, wget, python or perl
• unusual outbound connections, high CPU use (crypto miners) or outgoing spam

Recently changed PHP files

sudo find /var/www -type f -name '*.php' -newermt '2026-10-20' -ls

Adjust the path to your web root. Changes you made yourself, such as updates, show up as well.

Suspicious code

sudo grep -rlE 'eval\(|base64_decode\(|gzinflate\(|shell_exec\(|passthru\(' /var/www --include='*.php'

Legitimate software uses some of these functions too. Look at the file and where it is before you draw conclusions.

Cron jobs, users and SSH keys

sudo ls -la /etc/cron.* /var/spool/cron/ 2>/dev/null
sudo crontab -l -u www-data    # on RHEL: apache or nginx
awk -F: '$3 >= 1000 {print $1}' /etc/passwd
sudo find / -name authorized_keys -newermt '2026-10-20' 2>/dev/null

Processes and connections

ps -ef --forest | grep -E 'php|www-data|apache|nginx'
sudo ss -tpn

Look for shells, download tools or scripts started by PHP or the web server, and for connections to addresses you don't recognise.

Logs

Look in the access logs of your web server for requests to PHP files that shouldn't exist and for unusual POST requests, from 20 October onwards. Keep the logs: you may need them later.

If you find something

1. Isolate the server: take it off the internet, or block all traffic except your own IP address. Don't switch it off: memory and running processes may hold evidence.
2. Keep the logs and, if you can, a snapshot of the disk.
3. Restore from a clean backup made before 20 October, or rebuild the server. Removing a single file is rarely enough.
4. Patch PHP before you bring the system back online.
5. Change all passwords and keys: database, application, SSH, API keys and secrets in configuration files.
6. Contact us at support@peaceweb.com with "Urgent" in the subject. We can help with the investigation.

Personal data

If personal data may have been accessed, you may have to report a data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of discovering it, and inform the people involved. Ask your privacy officer or legal adviser.