Post

WordPress core files or wp-config.php contain eval($_SERVER['HTTP_E21BC9D'])? Check cron too: it may restore a removed backdoor. Read the malware analysis. https://www.mdpabel.com/malware-research/wordpress-cron-core-wp-config-malware-reinfection/