You are right, I didn't look carefully, this is not simply eval(POST) backdoor, it has a payload and it is encrypted with an external key that is provided via P

You are right, I didn't look carefully, this is not simply eval(POST) backdoor, it has a payload and it is encrypted with an external key that is provided via POST or COOKIE; but I see some weak points and will try to guess the key. Maybe this code is encrypted using some generic obfuscation tool and the file at github matches the rule at report because their payload was encrypted with the same tool? I'll also add some thoughts under @wongarsu's comment.