[bsun]

While doing a quick security audit on an inherited installation of vBulletin, we were looking for recently modified .php files in the application folder and noticed that there is a file in the dbtech/vboptimise/filecache/ directory with a .php extension. (Specifically, the filename is what appears to be hexidecimal hash of some sort, followed by that .php ending.) The file appears to have no actual PHP logic in it, simply exiting from PHP and outputting a JSON object via normal text. (Object parts include what appear to be a "time" and a "value.") The file was modified today and is owned by the user that our webserver runs as.

In the interest of establishing a baseline against which we can do future audits: Is the creation of a .php file in the cache directory a normal behavior for this plugin?