I think they replace files automatically, because both my index.php files was modified at the same time.
I have drupal (latest version) on my website latest version and a simple php script that just shows time. There's a hole in the server. Cpanel, apache etc.