Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

today someone contacted me and showed me something very dangerous. he somehow managed to get the full source code of my php files, and he didnt wanted to tell me how. what are the reasons for this to happen? my server is with linux centos, and cpanel (including whm) thanx all!

share|improve this question

closed as not a real question by John Gardeniers, Wesley, mgorven, voretaq7 Oct 25 '12 at 18:36

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

possible duplicate of My server's been hacked EMERGENCY – John Gardeniers Jul 1 '12 at 0:52
There's not enough information here for us to help you. You could have a legit security breach, or just some badly configured <Location>s in your web server that are letting someone download PHP source without the server interpreting it first. You need to do some investigation - since the breach was reported to you try talking to the guy who reported it... – voretaq7 Oct 25 '12 at 18:36

Could be a result of the recent CGI issue reported against PHP:

Otherwise we need more details to go on. You might start by looking at your webserver logs to see if you can identify any atypical or suspicious requests.

share|improve this answer
i really cant give more details cause i dont got any :\ and which logs should i check? – avihaytracx Jul 2 '12 at 21:20
The apache logs. You're looking for a request for something that looks "unusual". – Steve Kemp Jul 3 '12 at 15:44
PS. If you're running wordpress, or similar, he could have just downloaded the code from the main project - not from your specific server - but update anything you're running to make sure you're not running an old known-vulnerable code. – Steve Kemp Jul 3 '12 at 15:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.