Today automatically added two admins to my site?
Is my site hacked?
What should I do to fix this bug?
- First of all, remove the new admin users and change the password for the main admin user (and other admin users if there are any)
- Change the password of MySQL and update it in the app/etc/local.xml file.
- Change the password for the hosting panel and the MySQL management tool.
- Scan your store for the security patches (with the help of https://www.magereport.com/) and install if any patch is missing from the store.
- Magento provides a scan facility for stores to help the merchants keep their websites safe. Register yourself on https://magento.com/security and scan your website.
Note: Don't share your secret credentials over a non-secure medium and change them regularly.
I hope it would help.