I have no idea, I wasn't able to access any logs or anything. It's possible they had already installed a backdoor using the first vulnerability before I patche

I have no idea, I wasn't able to access any logs or anything. It's possible they had already installed a backdoor using the first vulnerability before I patched it, or perhaps something else entirely (though that's a little too coincidental)