Host process running

cheeseglue · 07-14-2014, 03:25 PM

I operate a shared web server (CentOS 6) and I keep seeing the command "host" being run only by one specific user (a wordpress account). It will run indefinitely using up 15-30% CPU.

I'm able to terminate the PID with kill, but is there a way I can find out what is causing the command to be run?

I haven't seen this process running from any other user. Oh, and I'm not running a DNS server on this machine.

szboardstretcher · 07-14-2014, 03:41 PM

That sounds like a hacked WP server. Are you up to date? Running a vulnerable version? A quick search pulled this up:

http://serverfault.com/questions/576...-ubuntu-apache

Hope that helps.

cheeseglue · 07-14-2014, 04:01 PM

Thanks for that heads up szboardstretcher

Everything is up to date: CentOS, Wordpress and its plugins. No one-off plugins installed, everything seems good.
I've tried changing passwords as well. Still trying to figure this out...