He was looking at a dead man's dead drop.
He wasn't looking at a simple image host. Scripteen Image Hosting v2.7
He stared at the code of index.php again. He had read it a hundred times. But tonight, he noticed a tiny, clever hook in the imagecreatefromjpeg() function. A block of base64 encoded logic that unpacked only if a specific byte sequence was present in the EXIF data. He was looking at a dead man's dead drop