db.php kept coming back every 10 minutes
A postmortem of one WordPress site: an upload plugin let PHP in, and out of it grew a webshell, a dropper and a db.php loader. The first cleanup wasn't enough — persistence lived in WP cron and brought it all back every ten minutes. What to look for when malware returns after deletion.