This question already has an answer here:

How can I prevent php scripts from overriding max_execution_time value ?

Someone found a way to inject malicious code on a server through wordpress... We are in the process of patching the vulnerability. That php code defines :

@ini_set('max_execution_time', 0); @set_time_limit(0);

That kept on crashing my apache server... Is there a way to disallow such override?

marked as duplicate by Tero Kilkanen, mdpc, Jenny D, kasperd, MadHatter Mar 28 '17 at 14:47

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.



Your server got hacked - that was bad.

You found out about the problem because the code running starting exhibiting strange systems - that was good.

You want to prevent your system from exhibiting the systems of an attack in future - that's bad.

That it got hacked in the first case and you are now able to apply a fix which would have prevented this rather implies that the initial compromise was your fault.

  • Thank you, I totally agree with your point of view... We are in the process of removing injected files, preventing the script from changing the max execution time is just one of temporary countermeasures to make apache start again... The initial compromise was through a wordpress plugin... – Phlocon Mar 23 '17 at 16:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.