A server hosting 5 500 WordPress sites experienced repeated crashes, initially suspected to be a DDoS attack. The infrastructure included Debian 13, 125 GB of RAM, Nginx, MariaDB, and PHP-FPM 8.4.
Investigation revealed that PHP-FPM workers were consuming 600 MB of RAM each from the first request. This behavior triggered the OOM-killer, which repeatedly terminated MariaDB and Nginx, causing the sites to go down every five minutes.
The root cause was identified as a bug in OPcache that triggers during cache resets under load. The issue was exacerbated by the Yoast SEO plugin, which performed a delayed cache reset across 467 sites simultaneously.
The administrator ruled out external bot activity as the cause of the crashes. While external scanners were present, the server's instability was internal, stemming from the memory exhaustion caused by the OPcache bug.
