Variants of popular PHP web shells have been popping up and analysis reveals that they contain a hidden backdoor used to steal the unauthorized access.