ConfigServer Community Forum

Hello,

We have uncovered a suspicious file that i am overly surprised no scanner has picked up and its very concerning.

The filename is called 'indonesia.php'

I was sitting in one of our customer Wordpress installs and in some sub directories. The contents of the file is as follows.
Moderated Message:
We are in no way experts but that does seem to be malware.

Has anyone seen this before, or how is it that CXS being a paid solution even after a month did not pick this up ???

If you would like to submit an exploit for consideration you should use the following syntax: We will review the file and consider detection for it in the future. If you want to detect it yourself you can use the cxs --xtra [file] syntax with an xtra file (see documentation) to include your own detection for it.