New Service: Incident Response for Magento 2 and VPS
We’ve just launched a new offering dedicated to Incident Response for Magento 2 environments on OpenLiteSpeed and Linux VPS. The decision wasn’t random – we recently faced a serious security incident on our own infrastructure, and we want to share what we learned.
What Happened?
Malicious code infiltrated our VPS, establishing persistence – the ability to maintain access indefinitely. The challenge was that the infected file kept overwriting other files, creating new webshells even after we deleted the originals. Removing the file does not solve the problem, because something else recreates it.
How We Fixed It in 2 Days?
1. File Permission Changes We tightened file permissions – ensuring only the web server process could read them, and preventing infected code from writing arbitrary files across the system. First line of defense.
2. Fresh File Uploads We restored original Magento 2 files from trusted sources, replacing every infected version.
3. Deep Filesystem Scanning We used specialized tools to scan the entire system for malware remnants – both visible and hidden.
4. Firewall Reconfiguration We hardened firewall rules, blocking unnecessary outbound connections that could have been used for spam or C&C communication.
5. Log Analysis and Audit We analyzed access logs, error logs, and cron jobs to identify the entry vector and confirm no other backdoors remained.
6. Configuration Hardening We secured OpenLiteSpeed, PHP, and Linux configurations according to security best practices – disabling dangerous PHP functions, restricting uploads, strengthening access controls.
Why Was This Difficult?
Persistence is the hard part. If you do not know where the malware hides and how it regenerates, you remove the main file and it returns within the hour. Recovery needed a fixed order of steps, log monitoring while we worked, and a check after each change.
What We Offer Now?
Based on this experience, we built an Incident Response package that covers:
- Immediate environment isolation
- Forensic analysis of the compromise scope
- Entry vector identification
- Malware removal with durability guarantee
- Full environment hardening
- Post-incident monitoring
We know it’s difficult – because we’ve been there. But we also know it’s possible.
If you’re facing a similar incident, reach out.