Original link: PHP backdoor looks to be work of Chinese-linked APT group / CyberScoop.
Details are here.