Google Search Console showing pages which doesn't in my site

I am facing this weird issue with Google Search Console. It is showing pages and content which doesn't exist. My site is in English but it is showing Japanese content for some pages. I noticed it a couple of days ago when Google started showing mobility errors like font too small or content too close to each other for some pages.

Here is one such example. Have a look at my page below.

https://www.backpacksupport.com/buying-guides/backpacks-for-cats-a-guide-to-exploring-the-great-outdoors/
And now check what GSC is showing:



And also this:



And look at the screenshot in Google search index:



Google cache is showing the same Japanese page.

http://webcache.googleusercontent.com/search?q=cache%3Ahttps%3A%2F%2Fwww.backpacksupport.com%2Fbuying-guides%2Fbackpacks-for-cats-a-guide-to-exploring-the-great-outdoors%2F&rlz=1C1VDKB_enQA1064QA1064&ei=fNucZM2WELzg7_UPsK65wAU&ved=0ahUKEwjNxNOgp-f_AhU88LsIHTBXDlgQ4dUDCA8&uact=5&oq=cache%3Ahttps%3A%2F%2Fwww.backpacksupport.com%2Fbuying-guides%2Fbackpacks-for-cats-a-guide-to-exploring-the-great-outdoors%2F&gs_lcp=Cgxnd3Mtd2l6LXNlcnAQAzIHCAAQigUQQzIHCAAQigUQQzIFCAAQgAQyBQgAEIAEMgUIABCABDIFCC4QgAQyBQgAEIAEMgUIABCABDIFCAAQgAQyBQgAEIAEOggILhCKBRCRAjoICAAQigUQkQI6CggAEIoFELEDEEM6CwgAEIAEELEDEIMBOgsIABCKBRCxAxCDAToICAAQgAQQsQM6DgguEIAEELEDEMcBENEDOhYILhCKBRCRAhCXBRDcBBDeBBDgBBgBOggIABCKBRCxAzoLCC4QgAQQsQMQgwE6EQguEIoFELEDEIMBEMcBEK8BOggILhCABBCxAzoNCC4QigUQxwEQ0QMQQzoHCC4QigUQQzoKCAAQgAQQsQMQCkoECEEYAFAAWOwKYJcMaABwAXgAgAHXAYgB5gmSAQMyLTaYAQCgAQGgAQLAAQHaAQYIARABGBQ&sclient=gws-wiz-serp

I have no idea what's going on here. It doesn't make any sense.

By the way I noticed it is happening with another site too which is on same VPS. Is my VPS hacked or something?
But why when you open the site normally in browser then it shows correct page? Is it some DNS injection or some kind of poisoning issue?

After little searching, I have found out that site is indeed hacked or injected. VPS appears to be fine (haven't checked it deeply) so I wonder how they did it? Using some bad plugin or some other vulnerability in WordPress? I keep my WP updated....including all plugins and themes so I am not sure how they got to it. Still looking!

They are in your site for sure, Check this on Google
Site:yourdomain.com

I think someone inject some code on your publich_html folder.

Plugins nulled, outdated or even paid with just bad coding aka adinserter pro, HTTP security headers, outdated things like cve in backend software like your lemp lamp or whatever stack, vps firewalls and then users that have a vps that don't even configure PHP to execute certain things only, database practices, or even users doing chmod 777 on all files, god I can keep going that's just a drop.

Then you got the zero day exploits, so having decent waf, locking off admin areas if single user is easy, blocking .PHP file extension, blocking uploads in many ways depending in situation.

Lot of this is easy, just need to look into it. The Japanese hack is well known so it ain't a zero day exploit sadly.

Found these two problem files on site root.





Compared it to clean wordpress installation and found out that index.php has been modified and inputs.php doesn't exist so this is a new file added.

You got hecked. Something normal on wordpress websites.