My PHP is poor, but it looks like it was being changed to check for a string coming in via a "typo'd" HTTP_USER_AGENTT header, that started with zerodium, and then eval the string without the zerodium prefix on the server.

Reminds me of that Linux compromise years ago where they picked it up because the change was directly on the build box, except at least that one was hidden behind an apparent `=` vs `==` "bug" - this one has a bit less style.