Hello there, I’ve been using HestiaCP on multiple servers for many years, and so far, so good. However, at the moment I’m dealing with a critical situation. One of the servers (luckily, just one!) with a pretty much default installation (MySQL + PHP-FPM, etc.) got compromised. There are over 50 Ma…

Maybe magento and then over a privilege explotion, but that’s just guessing - as the server got infiltrated and logs cleared, its probaly impossible to find out now. I would make backups of each user, wipe the server, restore the backups and check for any fishy leftovers (maldet), then proceed with …

Has a vulnerability been found in your outdated Magento shops? All the evidences you’re describing point to a malicious exploitation…

Yes. These magentos are outdated, compromised etc, and were compromised since months. But how someone gained root access? Used some lately found with AI privilege escalation bugs?

Maybe they were there from time ago. Check this thread and investigate if this can be your case: [image] Web Terminal Hack Community Support NOTICE: If you are running the Web Terminal plugin disable it ASAP. The Web Terminal can be exploited to gain root. I…

Thank you for your answer. I’ve checked that option already - Web-terminal is, and was always disabled.

Perhaps plugins gave root access to the server, also web terminal even disabled could cause the problem, it should be removed.

Do you have any idea how to confirm it? Trace it?

I dont believe its from the terminal, there are a lot of servers, none report something like this, you have to trace magento it self and their plugins.

Looks like there are maaany requests related to PolyShell: unrestricted file upload in Magento and Adobe Commerce | Sansec Some are successfull (200) :confused: And later, with webshell maybe someone used some privilege escalations vulnerabilities lately discovered…

This happen very often when you use cms plugin file managers… happened to wordpress on a lot of fms and many versions after a patch after some versions again…Now you have a start, check plugins versioning and you will see when the problem caused. It will be hard to clear all sites… If you have previ…

Yes, @Blats . I managed to restore server, Hestia, configs etc from the backups. I have upgraded the system and will try to block anything related to PolyShell on nginx. And I’d like to thank you all for the responses and support, even if the subject seems to be not really related to Hestia and its …

Server compromised after update to 1.10.3

Community Support

masterguru August 23, 2026, 12:32pm 4

Maybe they were there from time ago. Check this thread and investigate if this can be your case: