Website suddenly starts to download PHP file while no one touched the server

[shenkwen]

**Operating system:**Ubuntu
**OS version:**18.04

One of my websites hosted on this server suddenly starts to download PHP file instead of executing it Last time I saw it running was months ago and I didn’t touch the server setting at all during this time. I didn’t even upgrade packages as I’m supposed to(ya I’m just lazy). This site is built with Wordpress, and I have tens of other sites on the same server, they are all built with Joomla and they are all running well.

There are quite a few posts on this forum about the same issue, but before I set out to resolve it I’d like to ask what could possibly causing this issue to occur while no one touched the server? It looks suspicious to me - does it mean potential breach?

[Joe]

@shenkwen

but before I set out to resolve it I’d like to ask what could possibly causing this issue to occur while no one touched the server?

A package update happened that replaced one of the configuration files we modify during installation (probably php.conf in the conf.d directory).

@shenkwen

It looks suspicious to me - does it mean potential breach?

I can’t imagine an attacker would update your software.