FIM: new script file in web upload directory

The customer portal has a folder that should only hold pictures. A script file (PHP) has appeared in it and someone is running commands through it. This could be a hidden back door called a web shell.

Your task: Decide how serious this is. Find out who uploaded the file, whether it was used, and what the attacker could see.