If someone was able to gain access to the server and there was no key, they would report it here with proof. If someone had a working PHP exploit and it didn't work on this server, they would be able to post it here with proof.
I suspect that they in fact do not particularly care about what you think.