- Update INCIDENT_RECOVERY_2026-01-19.md with complete recovery status
- Create VPS_RECOVERY_REFERENCE.md with step-by-step recovery guide
- Update remediation plan to show executed status
- Update OVH rescue mode doc with resolution notes
Documents the successful complete reinstall approach after multiple
failed partial cleanup attempts. Includes attack indicators, banned
software list, and verification checklist for future incidents.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Documents three botnet attacks (Dec 2025, Jan 18 x2)
- Root cause: PM2 process manager running malware (should never have existed)
- December recovery was incomplete (umami-deployment, PM2 not removed)
- Current status: Website UP, SSH BROKEN
- Full SSH keys documented
- Lists all recovery actions taken
- Acknowledges Claude Code failures
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
