Originally Posted by
Painthappy (from MCB Thread)
Checked and double checked the logs. They didn't get into the server via hacked passwords or traditional methods. Definitely a hole in the software.
So in lies the problem. Have backups, but can't just slap back up the software that they hacked.
Put on the latest and greatest software with no issues onto a new server that we also know has not been compromised. We are good now. Now comes the task of trying to import some of the old stuff, but safely and carefully. Have to go through it to make sure nothing in it is wrong also. Can't poison the new server nor do we know when it all truly happened.