Got hacked with SHELL c99 and r57

[dk.mmmm]

Hello,

My PHP have disabled many functions like:
exec, passthru, shell_exec, system, pcntl_exec, leak, apache_child_terminate, posix_kill,posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, escapeshellcmd, escapeshellarg,show_source, ini_restore, dl, dl dl dl

But today, one of my client got hack local again, with c99 and r57.

I have tested, r57 can still excute dir /home/username , and cat /

How to fix , please help.

 

[NiteWave]

how about enabling safe mode ---
http://php.net/manual/en/features.safe-mode.php

 

[dk.mmmm]

how about enabling safe mode ---
http://php.net/manual/en/features.safe-mode.php

Safe Mode have disabled from PHP 5.3 , it's not help.

I see LiteSpeed have Body Scan now, how to use it detect c99 , r57 ?

 

[NiteWave]

please refer:
http://www.litespeedtech.com/support/forum/showthread.php?t=2735

there may be some useful info for you

 

[dk.mmmm]

please refer:
http://www.litespeedtech.com/support/forum/showthread.php?t=2735

there may be some useful info for you

Nevermind.

So, that mean, only use LiteSpeed for your own website, cant not use LiteSpeed for Bussiness Web Hosting, because Litespeed not security like Apache + mod_security.

Too bad, now I come back to Apache because this reason.