We are seeing a very weird situation for the last 2 days. On our website - PHP/MySQL based - we have the following situation -

We have a number of directories under public\_html, all owned by apache:apache. These directories have execute permission for all.

We are seeing that the permissions on these directories keep getting changed - the execute keeps getting removed. We cannot figure out why and what is doing this? Obviously, the concern is that someone is trying to alter the website, using the apache account (which is setup as a nologin account).

Any help would be appreciated.