yeah this is like java rhino all over again, except in reverse. instead of:
- user goes to site
- java applet runs and executes arbitrary code
its
- malware hits site with unauth rce against php
- site runs command