mattwiner

It looks like it:
https://wordpress.stackexchange.com/questions/333380/is-this-a-hacking-script-in-function-php

We got the SAME exact thing just about 2 days ago too. It was sucking up 8gb of ram, creating over 1000 httpd connections and hundreds of mysql connections.

Took 2 days to figure it out. Any idea where it came from? Some plugin?

We too created and empty code.php file and it stopped.

• This reply was modified 5 years ago by mattwiner.

I haven’t heard back from Amazon yet. But another issue I was having was I was running out of memory. The server has 4GB of RAM and it was telling me in the error log that I was running out of memory.

So I upgraded the memory so I could actually work on the system a bit. But after running a netstat I see I have over 900 connections from my localhost!!!

According to my google analytics I have 0-1 person on the site, my database has > 140 connections and all these users.

I thought it was a ddos attack, but it’s coming from inside, not out.

netstat -ant | awk ‘{print $5}’ | cut -d”:” -f1 | sort | uniq -c | sort -nr

906 127.0.0.1
567 172.31.26.136
206
4 0.0.0.0
3 54.84.127.13
2 52.202.74.172
2 173.165.202.202
1 and
1 Address

So this is even more weird now. The connection to the DB is very intermittent.
I created a very simple test connection script. When I refresh it. 30-40% of the time I get “Could not connect”

<?php
$link = mysqli_connect('wpdb.xxxxxxx.amazonaws.com', 'username', 'pass');
if (!$link) {
die('Could not connect: ' . mysqli_error());
}
echo 'Connected successfully';
mysqli_close($link);
?>

care to share? I’m having the same issue. Thanks

any luck with this?
I found that the push CDN was much faster but had issues with cached/minified CSS/JS not loading and getting tons of 403 errors (couldn’t find the files)

Do you get any errors in the console? Can you manually visit the s3 links to see content? Are you using the CDN, if yes origin pull or push?

ok that was a bad example because that CSS file existed.

But the HTML seems to be generating correctly.
Here’s what I see in the html:
https://d329ynpon1fy87.cloudfront.net/wp-content/cache/autoptimize/css/autoptimize_f2c5cd3ac490702263942d129d16ee12.css

Just so I understand, when the page is requested, AO checks to see if the CSS is cached, if it’s not, then a new file is generated? So there would be a delay in both generating new optimized CSS and JS, and then of course in a push CDN getting the file to the S3 bucket?

But the push CDN using the s3 bucket is so much faster then a pull from origin CDN.

Now, if we make an update to a page, the next visitor will automatically regenerate new optimized CSS/JS correct? So the first visitor will have a slower visit.

It’s weird that some item are pulled from one CDN vs the other.
https://www.glossyfinish.com/dev/screenshot_sources.png

Thanks

The push url for a css file for example is:
https://cdn.glossyfinish.com/wp-content/cache/autoptimize/css/autoptimize_f2c5cd3ac490702263942d129d16ee12.css

The pull url is basically the same thing just with the base as: https://d3jujkn47xr44k.cloudfront.net.