Hacking attempt or server bug?

Question

Burglary protection

I ran into a problem last night, I worked through FTP on the site, after which I went to bed and left everything in an open state, no one approached the computer, after another work I found that the site did not open, files such as admin_ajax, php, bb appeared in the root directory. php , and a couple more index.php was also completely changed. To some kind of scribble, what could it be? no one has access, passwords are
secure p.o - Centos 7 apache, cpanel + whm

Answer 1

no one has access

well, that's what you want.
Well, obviously not your ftp client came up with them, and obviously as a result of some error, files with meaningful names may appear.
You can attach the file code to the question if you want a more detailed answer. What's in admin_ajax?