It appears to be another spin on an old php exploit with phpSecurePages.
I'd be interested in knowing if there were any machines hit that did *not* have a copy of the file secure.php anywhere on their server.
Here is another version of the one that hit boneprone...from Iranian hackers.
http://www.milw0rm.com/exploits/2452
Though the above link is safe, I do not recommend going to any links found in that code (or any other exploit code for that matter).