I believe a site I've been working on has been hacked.
Here's what I know:
- PayPal seller address has changed to a random address
- This is not a PayPal bug
- Going through the logs - this wasn't changed through the Magento admin
- No one has access to the AWS EC2 instance besides me
- What is being changed is the row with path
- Chances of MySQL injection seems fairly low. I've grepped through the nginx and Varnish logs for 'select' - should I be grepping for anything in particular?
I would appreciate advice on the next steps to take as an answer.