That depends on how you've set it up.
As a normal user that can execute or even just read scripts, I can hunt through them to find any plaintext usernames or passwords for things like SQL connection strings or remote copy (like SCP) commands for herding files around.
There are plenty of vulnerabilities in many old PHP versions that make it possible to "break out" of a user shell into something more powerful. Make sure you're running updated versions of your software and that everything still gets security updates.
Since you mention only rootkits, I'm assuming there was some kind of user escalation. However, there are plenty of things a normal user with a shell can do that you definitely don't want to happen. While your entire node may not be compromised in that case, your scripts may be - and you can do quite a lot with that. Make sure your script permissions are tight.
In general, this question is way too broad to actually answer. You're asking a question that is answered by the breadth of an entire professional field.