looks like a remote exploit that ran some filesystem-level stuff to propagate itself; found php files in backup dirs tampered with. fun!