httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Nick Kew <>
Subject Re: [users@httpd] Signs of Apache Web Server been hacked
Date Mon, 11 Nov 2013 00:55:35 GMT

On 11 Nov 2013, at 00:15, Rizwan Raza wrote:

> Notice the last two listings. What does that mean? Is my Apache instance hacked?


The most likely origin of a shell from apache is from a script.
That could be a vulnerable script that's got hijacked, or a script
that intentionally runs a shell.  Processes hanging around
could mean a script that didn't run&exit cleanly (and should
be fixed).

Take a long hard look at your scripts, and look for any clues
in your error log.

Nick Kew
To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message