I disagree. If it is PHP code execution, it should be ARCH_PHP. Using PHP code to execute ARCH_CMD payloads adds more complexity and probability that the victim's environment will cause failure.