Thank you! I've looked at a lot of PHP malware and a good portion of it is impossible to understand because it's hard to tell what the intent is. Bug or probe?

Thank you! I've looked at a lot of PHP malware and a good portion of it is impossible to understand because it's hard to tell what the intent is. Bug or probe? Typo or clever coding trick? Cut-n-paste or testing only against SunOS 4.10 server?