What to do if bad actors compromised your website?

Hello cybersecurity experts. I’m looking at some alerts yesterday and the scans picked up suspicious activity on a clients website. They think they’ve been hacked.

A lot of Apache Struts detection, Blind SQL, NoSQLI Injection, SQL Information Leakage vulnerabilities have been found.

What’s the best approach here? Change the website admin passwords?

What about their servers and other hosts on their network?

I’m new in the industry and our senior cyber security person is away on bereavement leave and is …

bad compromised cybersecurity website