Laravel 8 Site Was Hacked

What else can I do to ensure that they cannot get back in?

@requincreative If you left APP_DEBUG to true then consider all of your environment variables compromised. That means you need to change your database credentials, rotate your API keys and other secrets immediately. Do this for everything.

Even with just say, a Mailgun API key, an attacker can now use your Mailgun account to send spam emails and it’s going to be your domain’s reputation that will be harmed when recipients start marking mails as spam en masse.

For Forge, change your account password and enable 2FA if you haven’t already. It’s good practice to use 2FA on all sites that support it, and to also use unique email address and password combinations for each site to prevent credential stuffing attacks. A lot of email services will allow you to create aliases. For example, with a Google-based account, you can add an alias with a plus symbol after the first part of your email address, so instead of using just [email protected] you can use [email protected] instead.

Next, you need to determine just how the attacker was able to actually get code on your server. So check the file permissions of all files on your server, and then check any parts of your application that handle file uploads for vulnerabilities.

Finally, depending on where in the world you are located, you may now have a legal duty to report this breach to your local authorities. Here in the UK you would need to register the breach with the ICO. A lot of other countries will have similar practices, particularly developed nations like those in the EU and North America.