I have a webserver with Apache ITK, configured for a specific vhost to use a specific username within it's folder. Now, this user is an owner of the files, but has no write permissions in the folder in question, however yesterday, the site has been compromised and two files with write permission have just appeared in the folder.
My question is: How?
I understand that if a website is compromised, a lot can happen, but the website is still running from within the context of that username, which simply did not have permission to write any files to that folder. Or am I understanding permissions incorrectly?