i do not know details. I am pretty good with security stuff, but this time i had no clue. basically somebody was able to get root permissions on the webserver,

i do not know details. I am pretty good with security stuff, but this time i had no clue. basically somebody was able to get root permissions on the webserver, 'cos (s)he removed all system log files. Then (s)he was able somehow to hack into my laptop and desktop connected to this webserver via VPN. My local machines were running regular dev stuff: apache, nginx, mysql, etc, but nothing with obvious vulnerabilities. And on top of it - (s)he removed log files, which could be done only by having root access to both machines. Nothing in authlog (i restored it), nothing in wtmp.. I made byte copy for later research, but at this point in time - no clue how this could happened. While I can suspect hosting staff doing this on server - it really boggles my mind how it could be done on two home remote machines, both running different Ubuntu versions. ps: bizarre part was - once i realized it happened, I started doing research on webserver and (s)he started kicking me out and banning IP address in firewall! the only way to finally get to the machine was to reboot it in single mode (my hosting provider allows to reboot it in single mode and start ssh for root account with random password)