Not sure if this has to do with a update.. But I been finding these files recently .ea-php-cli.cache files with 777 permissions
Anyone know what they have to do with? maybe a hack of some sort? the times do not make much sense tried going through the visitors logs and didn't see much.