Horror after the hack - how is this possible?

Question

Command line

Gentoo hardened.
I, a normal user, suddenly can edit files owned by root. Also, the files I create immediately become owned by root.
?????????????
Root himself is in prostration, drinking with grief, because he could not understand what happened.
Hack vector - drupal + php-fpm + nginx (presumably - downloaded php with shellkit was found, but immediately removed).

Answer 1

If I were you, I would now start looking for a specialist capable of finding and neutralizing. And your root is strange if the problem makes him depressed and not a state of sports interest.