VPS Security Incident Investigation, Malware Removal & Server Hardening

We are looking for an experienced Linux server security specialist to investigate and resolve a security incident affecting our VPS environment. Our VPS hosts multiple domains, and each domain runs its own custom PHP-based order management system. These systems are business-critical and are used by both our staff and our customers. One of our primary domains is currently affected. Users are unable to log in, and administrative access has also been impacted. However, we need the entire VPS environment investigated, not just the affected domain. We are looking for someone who can identify the root cause of the issue, completely clean the server, verify the integrity of all hosted applications, and implement security measures to prevent this from happening again. Scope of work: Perform a complete security audit of the VPS. Identify the source of the security breach. Investigate all hosted domains and applications. Detect and remove malware, backdoors, malicious scripts, injected code, and unauthorised files. Review all custom PHP applications for vulnerabilities. Inspect databases for unauthorised changes or malicious code. Restore all affected services and functionality. Review server configurations, user accounts, SSH access, file permissions, and scheduled tasks. Update and patch the operating system, PHP environment, web server, libraries, frameworks, and dependencies. Implement server hardening and security best practices. Configure firewall rules and intrusion prevention. Implement malware monitoring and ongoing security measures. Review and improve the backup and disaster recovery process. Ensure all hosted websites and applications are fully operational and secure. Deliverables: A fully cleaned and secured VPS environment. Restoration of all affected services. Documentation explaining the root cause of the incident. A summary of all vulnerabilities that were identified and resolved. Recommendations to reduce the risk of future security incidents. Requirements: Strong Linux server administration experience. Experience with VPS security and incident response. Experience with custom PHP applications. Experience working with multi-domain hosting environments. Ability to start immediately. Please include the following in your proposal: Your proposed approach. Estimated completion time. Fixed-price quote.