Warning The vulnerabilities PHP2Shell and HTTP2Shell are being heavily exploited right now. Many websites and servers are affected. Please check here first whether you are affected. Am I affected?
Servers & clusters · Forensics
Server hacked? We find what is hiding.
Good attackers hide. The server then only shows what they allow. We look deeper and tell you: clean, hacked or rebuild.
What you get
-
A clear answer
Clean or hacked, with reasons. You know what to do next.
-
What else is affected
Which passwords and systems the attacker could have reached.
-
Evidence for insurer and authorities
We secure first. That keeps the evidence usable.
-
Secure afterwards
If you want, we rebuild the server clean and hardened.
→
Where attackers hide
A virus scanner asks the server itself. A good attacker fakes exactly that answer.
-
In the system core
A module slipped into the kernel. The server then hides programs, files and connections.
-
In the tracing tools
Newer attacks use the tools developers use to watch the system. From outside everything looks normal.
-
In swapped programs
A fake login program records passwords. It looks like the original.
-
In the reboot
Hidden entries make sure the attacker is back after every reboot.
Process
-
Secure
Secure memory and disks before anyone reboots.
-
Check deep
Ask the system core directly and compare the answers.
-
Check programs
Compare every program with the clean original.
-
Cross-check from outside
What the firewall sees against what the server says.
-
Report
Result, timeline, next steps.
Acute suspicion
Do not reboot. Unplug the network and call.
A reboot often wipes the only evidence. Leave the server running.
Scope
One server or all of them. With a report at the end.
Billed by effort. In an emergency we start right away.
For IT leads
Technical detailsftrace · kprobes · perf · eBPF · bpftool · bpftrace · auditd · rpm -Va
- Acquisition
- Image of memory and disks before any change, checksums and chain-of-custody log.
- Kernel
- Comparison of /proc/modules, /sys/module and kallsyms, taint flags, module signatures.
- Tracing
- Check of enabled_functions and registered kprobes for foreign hooks, analysis with ftrace and perf.
- eBPF
- Inventory of loaded programs and maps with bpftool, search for programs attached to syscalls and tracepoints.
- Userland
- rpm -Va with static tools from clean media, ld.so.preload, PAM modules, SUID files.
- Persistence
- systemd units and timers, cron, udev rules, initramfs, authorised SSH keys.
- Network
- Comparison of firewall and flow data with the connections the server reports, external scan.
Further reading
-
PHP2Shell: Was Website-Betreiber jetzt tun müssen
Two critical PHP flaws are being exploited since October 2026.
→ -
Got Hacked? Immediate Steps for Austrian Businesses
The first hours matter: isolate systems, preserve evidence and stabilise operations methodically.
→ -
KI findet Sicherheitslücken am Fließband: Was das für Ihre Server heißt
New AI models find vulnerabilities faster than ever.
→
FAQ
Frequently asked questions
Is a virus scanner enough?
No. It asks the server itself, and that is exactly the answer a good attacker fakes. We also check from inside and outside.
Should we reboot?
No. Disconnect the network, leave the server on, call us.
Do you check Windows too?
This analysis is for Linux. For Windows our IT emergency service helps.
Who is this for?
For companies with about 30+ staff and anyone whose servers must not stop. With or without an in-house IT team.
Contact
Free first call
Briefly describe your situation. We help you assess it and plan the next step. Reply within 24 hours on working days.
Detecting rootkits and checking hacked Linux servers in Austria
vetosec examines suspicious Linux servers for LKM, eBPF and ftrace rootkits, tampered binaries and persistence, with evidence capture and a report.
office [at] vetosec [dot] at · vetosec.at/contact/