Search for PHP shell scripts and PHP exploits

Replace the path below (.) with the absolute path of the directory you want to recursively scan. For example, you could recursively scan from the working directory:

grep '((eval.*(base64_decode|gzinflate|\$_))|\$[0O]{4,}|FilesMan|JGF1dGhfc|IIIl|die\(PHP_OS|posix_getpwuid|Array\(base64_decode|document\.write\("\\u00|sh(3(ll|11)))' . -roE --include=*.php*

Path to replace . which will all public-facing web folders on a Cpanel server:

/home/*/public_html/

So it will be:

grep '((eval.*(base64_decode|gzinflate|\$_))|\$[0O]{4,}|FilesMan|JGF1dGhfc|IIIl|die\(PHP_OS|posix_getpwuid|Array\(base64_decode|document\.write\("\\u00|sh(3(ll|11)))' /home/*/public_html/ -roE --include=*.php*

cpanel increase tmp , how to resize tmp

if your server’s tmp is getting filled up very fast and want to increase it.
I give you list of commands and instructions on how to resizing the tmp partition?
Note: this works only on CPanel server.
1- edit the file: /scripts/securetmp

nano  /scripts/securetmp

2 – find and change the following value:

my $tmpdsksize     = 5120000;    # Must be larger than 250000

5120000 = 512MB
if you want 1GB replace it with: 10240000
2GB : 20480000
3 – now we want to delete the old tmp partition

lsof /tmp

4 – Then umount /tmp and /var/tmp:

umount -l /tmp
umount -l /var/tmp

5 – Then remove the corrupt partition file:

rm -fv /usr/tmpDSK

6- Then create a new one: (only valid for Cpanel servers)

/scripts/securetmp

done.