...
As far as our Nagios was concerned everything was fine, because the main web page still gave back a nice 200 OK 
To add insult to injury to insult, the page that were served were unparsed PHP files, including all kinds of sensitive information such as database logins, file locations etc.
...