Is anyone catch this php?   Maybe add folder where hackers put file to some synch software, like dropbox , who have file history.
Or just try to restore deleted file.