Carberp Remote Code Execution: Carpwned

[SysAdMini]

http://www.xylibox.com/2013/06/carberp-remote-code-execution-carpwned.html

Everyone are looking at the Carberp source, bootkit and other components but did people investigated the panels source ?
I don't know who did the PHP but he deserve a medal, it's more easy to hack than SpyEye. (yeah i didn't think it was possible too)