Urgent Security Cleanup – Compromised Adminer on Private PHP Server

Description: I discovered that an old Adminer file (adminer-4.2.4-mysql-en.php) in the /administrator/ directory was left publicly accessible and successfully exploited. Logs show an attacker authenticated to the database and ran SQL queries. They appear to have created unauthorized admin accounts.Current situation:Attacking IP has been blocked I set the Adminer file permissions to 000 (currently inaccessible) The server administrator informed me that I cannot delete the file myself Environment: Private server (VPS/dedicated) PHP application MySQL/MariaDB database What I need you to do:Full investigation of the compromise (access logs, database activity, unauthorized accounts, web shells, modified files, persistence mechanisms, etc.) Remove any malicious or unauthorized admin accounts and clean related database changes Permanently neutralize the Adminer file (preferably delete it by coordinating with the server admin, or use strong alternatives such as moving it outside the web root, emptying the file, or proper access restrictions) Rotate database and application credentials Basic server and application hardening recommendations / implementation Provide a clear written report of findings and actions taken Requirements: Proven experience with PHP website/server compromise investigation and cleanup Comfortable working on private servers (SSH access preferred) Able to work within current restrictions and coordinate with the server admin if needed Please include in your proposal: Relevant past experience with similar incidents Your approach / first steps Estimated time required Access will only be provided after selection.Looking for an experienced and careful freelancer who can start ASAP.