we have a server, on which we host about 30 sites. these are test sites for our customers. most of them are not even indexed by google.
some run on php, some on nodejs, some on ruby. all of them that run on php have been infected.
on 27 and 28 of may in a lot of directories (not only the root ones) the following where created:
the consumer.php tries to connect to 18.104.22.168.
now i could just remove them and the problem would be temporarily fixed.
but how can i find out the entry point? i guess they used a bug in PHP (since only the PHP sites got infected)?