<snip> > B .Can i conclude that the attacker came through the horde framework ( cmdshell.php) > ? The horde framework was installed from the centos repo.....!!! > I don't think the horde set on CentOS is very current. I just used the tarball from the horde website, and I keep it current. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 258 bytes Desc: OpenPGP digital signature URL: <http://lists.centos.org/pipermail/centos/attachments/20090615/838ab6ad/attachment-0005.sig>