Ob_end_flush(): Failed to delete and flush buffer. No buffer to delete or flush at /index.php#1

[PHP] Errore: ob_end_flush(): Failed to delete and flush buffer. No buffer to delete or flush at /var/www/vhosts/domain.tld/cloud.domain.tld/index.php#1

GET /index.php/apps/logreader/poll?lastReqId=z3bKn85QN2DH6Q7Ds6TA
from x.x.x.x by me at 2023-05-08T09:49:36+00:00

Nextcloud version (eg, 20.0.5): 26.0.1
Operating system and version (eg, Ubuntu 20.04): Plesk on CentOS 7
Apache version (eg, Apache 2.4.25): httpd 2.4.6-98.el7.centos.7
nginx version (eg, Apache 2.4.25): sw-nginx 1.20.2.1-2.centos.7+p18.0.51.1+t230404.1037 (PLESK_18_0_51-dist)
PHP version (eg, 7.4): 8.1.18

The output of your Nextcloud log in Admin > Logging:

[PHP] Errore: ob_end_flush(): Failed to delete and flush buffer. No buffer to delete or flush at /var/www/vhosts/domain.tld/cloud.domain.tld/index.php#1

GET /index.php/apps/logreader/poll?lastReqId=z3bKn85QN2DH6Q7Ds6TA
from x.x.x.x by me at 2023-05-08T09:49:36+00:00

(repeat 4-5 times per second)

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php
$CONFIG = array (
  'passwordsalt' => '--',
  'secret' => '--',
  'trusted_domains' => 
  array (
    0 => 'localhost',
    1 => 'cloud.domain',
  ),
  'datadirectory' => '/var/www/vhosts/domain/.nextcloud/data/17fde2688e',
  'dbtype' => 'mysql',
  'version' => '26.0.1.1',
  'overwrite.cli.url' => 'https://cloud.domain',
  'dbname' => '--',
  'dbhost' => '--',
  'dbport' => '3306',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'nextcloud20',
  'dbpassword' => '--',
  'installed' => true,
  'instanceid' => '--',
  'maintenance' => false,
  'config_is_read_only' => false,
  'mysql.utf8mb4' => true,
  'debug' => 'false',
  'loglevel' => 2,
  'theme' => '',
  'default_phone_region' => 'IT',
  'app_install_overwrite' => 
  array (
    0 => 'occweb',
    1 => 'documentserver_community',
  ),
);

Another strange thing is some folders that I do not recognize and I can’t understand the reason they exists:

Probably an incorrect configuration of mine has left a breach open. Breach exploited by unknown to add code in some files to, as far as I could understand, send spam via email.

The system blocks (I hope) the sending of emails over 50 hours. I see from the logs that they tried to send a lot, about 8.000 have been blocked.

I’m checking all files for the problem to stop. And here the question arises: is precise and punctual control of all NC files possible?

integrity:check-core works perfectly (i cleaned index.php and other files).
integrity:check-app xxx works perfectly too, but there is a way to check all the apps?

Some files have also changed in the ./nextcloud/data folder.