@timcolman – That’s not a fix, you need to find and kill the source
We’re running about 60 instances on a shared server. For the most part, they run under a shared user account. What are everyone’s thoughts about unique user accounts? Will that, at least, stem the spread?