https://wilsonwu.me/en/tags/security/Recent content in Security on Wilson WuHugo -- 0.127.0en-USFri, 14 Aug 2026 00:00:00 +0000https://wilsonwu.me/en/blog/2026/azure-managed-postgresql-vs-self-hosted-security/Fri, 14 Aug 2026 00:00:00 +0000https://wilsonwu.me/en/blog/2026/azure-managed-postgresql-vs-self-hosted-security/Background Recently, a Linux server deployed on Azure suddenly started showing sustained 100% CPU usage. After investigation, I found a malicious program running as the postgres user, with persistence maintained through a cron scheduled task. The PostgreSQL installation on this server had the following characteristics: Port 5432 was not exposed to the public internet through Azure NSG; PostgreSQL was not used by the current business workload; The actual business workload used local MySQL; However, the PostgreSQL service was still installed and running; The system still retained the postgres user, home directory, cron jobs, and historical scripts.