Was My Magento Server Hacked? How to Check for PHP Remote Code Execution
php2shell leaked before the patch, so the first question is not when to update PHP but whether someone already got in. These are the read-only checks I ran on my own Magento VPS: worker processes, access logs, changed files and the Magento database.