Php-fpm issues just for a customer

[Light-FlashMad1]

Hi,

I'm running Php-fpm on many websites without any issues, this morning a customer who own 5 website in an account has had problem installing a plugin in wordpress and from that moment we starting to receive a lot of those emails:

1. Receive a lot of emails like:

Time: Thu Sep 7 13:45:28 2017 +0100

PID: 23214 (Parent PID:22785)

Account: removed

Uptime: 69 seconds

Executable:

/opt/cpanel/ea-php70/root/usr/sbin/php-fpm

Command Line (often faked in exploits):

php-fpm: pool removed_com


Network connections by the process (if any):

tcp: x.x.x.x:50612 -> removed

Files open by the process (if any):

/tmp/.ZendSem.4IxRis (deleted)

and all the websites of the same customer using php-fmp has started to go very very slow.

All the other websites (from other customers) still using php-fpm are instead still working fine.

I've tried to restart all the services included apache/nginx and php-fpm but nothing after a small while the issue back.

Anyone had a similar experience and could help me?

Thank you

 

[cPanelMichael]

Hello,

You can find discussion of this topic on the following threads:

Suspicious process running under user
Suspicious process running under
lfd suspicious process /usr/bin/php
wp-cron.php connecting to peer1

Thank you.