Conclusion

This is how a worm reproducing itself by exploiting vulnerabilities in PHP scripts can be created theoretically.

If the theoretical possibility of writing such code exists, it is impossible to guarantee that nobody implements it in practice. Therefore, you should be more concerned about computer security and should write reliable and secure scripts and applications.

Note 

Because this worm reproduces itself by exploiting vulnerabilities, it cannot reproduce in an invulnerable system.

Note 

Everything that a virus or a worm can do, a malicious person can do even more effectively. He or she can send requests to search systems, find vulnerable sites, and exploit vulnerabilities to use the server resources for his or her malicious goals.

A temporary protection against such viruses can involve enabling the allow_url_fopen directive of the PHP interpreter or prohibiting outgoing server connections. Be aware that these restrictions might affect the system's functionality.