There is no way to tell how a PHP shell has been used. If we found one then we would say that mandatory breach notifications apply.