Is someone trying to Hack? Receiving Suspicious Requests on my Apache2 Ubuntu 18.04 server
Stefan Bogdanescu
Founder & Senior Architect · 2026-06-29
# Is Someone Trying to Hack? Receiving Suspicious Requests on My Apache2 Ubuntu 18.04 Server
As a developer, there is no feeling worse than seeing unfamiliar activity on your production server. When you notice requests that don't belong—especially those pointing to unusual files or system paths—the immediate reaction is panic. You are right to be concerned. These suspicious requests are often the first sign of an active intrusion attempt, whether it’s a vulnerability scanner, an automated bot, or a determined attacker probing for weaknesses in your application.
Today, we will dissect the list of suspicious requests you provided and walk through a comprehensive, developer-focused strategy to diagnose the threat and secure your Laravel environment running on Ubuntu 18.04.
## Phase 1: Triage – Understanding the Threat Landscape
The list of URLs you observed—such as `/hudson`, `/cgi-bin/mainfunction.cgi`, `/?XDEBUG_SESSION_START=phpstorm`, and paths like `/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`—is not random noise. These are classic indicators of reconnaissance and exploitation attempts targeting PHP applications and the underlying operating system structure.
### What These Requests Mean:
1. **Directory and File Enumeration:** Requests like `/sitemap.xml`, `/index.php`, or paths pointing into `/vendor/` are attackers trying to map out the file structure of your server and application code.
2. **Web Shell/Code Execution Attempts:** Payloads involving `eval-stdin.php` or attempts to invoke functions (`function=call_user_func_array`) strongly suggest an attempt to execute arbitrary PHP code, which is the hallmark of a Remote Code Execution (RCE) vulnerability exploitation.
3. **Vulnerability Scanning:** Requests targeting common misconfigurations or security files like `/.well-known/security.txt` are often automated scans looking for known vulnerabilities or exposed configuration details.
4. **Internal System Probing:** Paths referencing system tools (`/nmaplowercheck1591708572`) indicate the attacker is testing if they have achieved a foothold and can execute commands on the server.
## Phase 2: Deep Dive Investigation and Hardening
Since you are running a Laravel application, the focus must shift to securing both the web server (Apache2) and the PHP application layer.
### Server-Level Security (Apache2 & OS)
First, secure the immediate entry points. Ensure that unnecessary execution paths are blocked at the web server level. Review your Apache configuration (`httpd.conf` or relevant virtual host files) to ensure that scripting execution is strictly limited to intended directories. For any public-facing file that should never be directly accessible, implement strict deny rules.
### Application-Level Security (Laravel & PHP)