Okay, I’m not seeing anything with recent dates that I didn’t do myself. Except for the new folder whoeveritis just created.
I asked my host for help, and they said: “But we have shell_exec and shell disabled from PHP, also, we run an scan every 2 hours that try to find phpshell scripts (besides of another exploits)”.
*shrug* I’m at a loss. I’ve tried to search for this online, but I’m not finding anything quite like it.