If your application is known to routinely "deserialize" (unsafe-eval) strings from a database or cache, an attacker might have placed a tiny backdoor that way, only to be used after the everyone has applied the PHP patches and attention levels & active staff are back to normal.