Trying to figure out if I was hit by an obscure exploit attempt of some kind

Question

I just had a random occurrence when I went to one of my hosted websites, and saw the page was broken.

We host several domains at this IP, but one domain is actually in the server's webroot directory, inside are all the directories for the 6 or so other domains, and other random assets. We use this server for dev and a few other assorted things...

The broken page (webroot/index.php - and a few other PHP files), appeared to have had a search&replace run on it, I thought it was just a screw up from another dev, but I also thought it was odd that the word "new" had been added ALL OVER THE PLACE (and no one fessed up even though it was an easy fix, so either they forgot they did something like this at 3 PM yesterday, or it was something else)

So like:

document.getElementById(new new new new new new new new new new 'main').....

and:

<h1 style="new new new new new new new new new new new new new align: middle;">

I don't currently have a reason to suspect an exploit, however, it goes without saying why the "new" keyword injected all over the place will freak a dev right out... It looks like it could be an attempt to gain access to the constructor method of something - but again, I'm out of my element here.

I can't find anything anywhere about the possibility of an exploit that features injecting the new keyword into PHP source code, but again, it doesn't sound like an unreasonable approach to gaining further access to a system. Is there any possibility that this is an established or new exploit vector? Do any of the infosec pros here see anything I should be deathly worried about?

Answer 1

So, it turns out that someone was using a copypasta script for checking file contents that, inexplicably, calls file_put_contents inside an if() declaration, I honestly didn't look at it long enough to consider why it was, I'm just glad that was the root cause. Turns out, the reason mostly PHP files were affected only, is that the script was written in PHP, and PHP-fpm doesn't have privileges to much else.

I still find this an interesting question, whether something like this could be used to fish for application vulnerabilities or so on; anyway, something about the thin line between a novel accident and a breakthrough? Hopefully this post wont inspire a maniac's creativity...