PHP backdoor attempt shows need for better code authenticity