First line of config files being written to

Support & Bugs
1

I have a fresh install of Piwik on Ubuntu 16.04 running PHP 7. Everything seems like it’s working, but about every 5 minutes or so, my global.php, global.ini.php, and config.ini.php files all have a single line of php written to the beginning of the file, like so:

Screen Shot 2017-05-07 at 22.00.21.png2560×1600 986 KB

When that line is there, the install is borked with php errors along the lines of “Unable to read INI file {/path/to/file/piwik/config/global.ini.php}: Syntax error in INI configuration: Your host may have disabled parse_ini_file”
I can remove the line and Piwik comes back up. But then the line gets written back in, and it goes down again.
Any thoughts? Thanks!!

2

Hi there,

unfortunately it looks like your server has been hacked and it has infected piwik as well. What other software do you run on the server? you need to upgrade them and if possible restore from backup

3

Thanks. I thought it was odd behaviour. It must be Wordpress :frowning:

I very much appreciate the response!