title: How do I handle a compromised AWS instance?
body: <p>Amazon Web Services notified me </p>
  
  <blockquote>
    <p>We've received a report that your instance(s):</p>
    
    <p>Instance Id: XXXX IP Address: XXXX</p>
    
    <p>has been making illegal intrusion attempts against remote hosts on the
    Internet; check the information provided below by the abuse reporter.</p>
  </blockquote>
  
  <p>I am running a Bitnami server on a single EC2 instance, which appears to have been compromised, and I'm trying to figure out the least disruptive way to fix the problem. Is the simplest solution to shut down the server, migrate my scripts and database to a new Bitnami instance, and change the administrator password?</p>
  
  <p>I'm not sure if this is relevant, but Bitnami sent me an email late last year indicating that my server was running an older version of PHP vulnerable to <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1823" rel="nofollow">this security problem</a> and to remove this version by executing this command</p>
  
  <pre><code>sudo rm -f /opt/bitnami/apache2/cgi-bin/php-cgi /opt/bitnami/apache2/cgi-bin/php-cgi.bin
  </code></pre>
  
  <p>I did this, but received the AWS notification within a week after I received this notification from Bitnami.</p>