Complete WordPress Malware Removal

A root-level server compromise via Yanz Webshell (Symlink Bypass) that infected core directories (.ssh, .cagefs) and injected 140 spam posts, rendering standard cleanup useless.

Forensics: Used Linux CLI on access-logs to trace the breach to an xmlrpc.php brute-force attack.

Wipe & Restore: Extracted clean databases and media, wiped the infected cPanel account, and deployed a fresh server architecture.

Hardening: Permanently blocked XML-RPC and updated the Defentry security engine to prevent recurrence.