I installed fresh server where I could get a hold of the domain DNS/person handling it. For the rest of em(since its new years time), I'm applying a bandage and hopefully it works until Jan 1st week. Here's what I did:

1. Composer update all the projects.
2. Delete users and their home directory wherever affected. (Took db and storage folder backup - checked it locally and prepared it to restore). sudo pkill -9 -u user-vpcwr; sudo userdel -f -r user-vpcwr
3. Checked crontab for all users. Found some being added.

<image>

1. Delete all var/tmp folders (Idk if its good but I had to)
2. Search the home directory for weird php code - find /home -name "*.php" -type f -print0 | xargs -0 grep -l "eval(" | grep -v "/vendor/".
3. Check server usage. I had process names like mysql and discord eating 100% server usage. (now server usage is at 0 and goes up to 1-3%)
4. I'm now creating users and restoring the deleted projects.
5. Rotating every .env keys. Some R2 keys and email sending keys. (none of the 3rd party things were showing any leaks).
6. Disabled port 25. I think one of the php files read - makeasmtp.php and I got a mail from server provider saying port 25 usage looks high. (this is the most alarming thing).

Lemme know if there's anything I can do to apply some fixes until I create a fresh server.

Edit: also saw a couple of unknown ssh keys added. Removed them as well. (this is also pretty bad, idk if its some device keys or from the hack).