Yeah this smells bad. Especially given the box is set up to not accept the exploit (1mb vs 12mb).
You mean the sever is setup with nginx defaults?
You mean the sever is setup with nginx defaults?