I have a random server in Frankfurt. It was just a dev server, but I knew that it had a Drupal install that I forgot to patch. I was running 7.56, and should have updated, but missed the SA-CORE-2018-002 patch on this server. (If you're not patched yet, shame on you!) This is a cautionary tale...
Note to reader: this was written originally to a friend over chat, so it's rather ... chatty...
A few days ago, I get an email from my VPS telling me that the CPU has been maxed out at 100% since 10 AM.