I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken.
We host several domains at this IP, but one domain is actually in the server's webroot directory, inside are all the directories for the 6 or so other domains, and other random assets. We use this server for dev and a few other assorted things...
The broken page (webroot/index.php - and a few other PHP files), appeared to have had a search&replace run on it, I thought it was just a screw up from another dev, but I also thought it was odd that the word "new" had been added ALL OVER THE PLACE (and no one fessed up even though it was an easy fix, so either they forgot they did something like this at 3 PM yesterday, or it was something else)
document.getElementById(new new new new new new new new new new 'main').....
<h1 style="new new new new new new new new new new new new new align: middle;">
I don't currently have a reason to suspect an exploit, however, it goes without saying why the "new" keyword injected all over the place will freak a dev right out... It looks like it could be an attempt to gain access to the constructor method of something - but again, I'm out of my element here.
I can't find anything anywhere about the possibility of an exploit that features injecting the
new keyword into PHP source code, but again, it doesn't sound like an unreasonable approach to gaining further access to a system. Is there any possibility that this is an established or new exploit vector? Do any of the infosec pros here see anything I should be deathly worried about?