Comment by FredFS456

They can be running a vulnerable version of PHP but also recording all traffic in a way that does not allow for wiping evidence afterwards. For example, if the PHP server was behind another server routing the raw IP packets and running tcpdump. Since the author of the site controls the TLS cert private key, TLS does not protect again the author eavesdropping.