Also short and sweet:
cat list | xargs rm
This assumes that you have a file named 'list' of all the malicious .php files and that you are in the directory containing the .php files (just to be clear, but I bet you already understood that).
If any of the filenames contain newlines, this will be dangerous to run, particularly because you already know they have been constructed by a malicious adversary. If you have the list of filenames in a text file you can check the list in advance and make sure that none of the lines will delete files you want to preserve.
Additionally, if the attacker managed to get malicious php scripts onto this host, this may not be your biggest problem. I am only answering the question you posed, and @soubunmei gave a better answer because she knew a bit more about the find command than me, but neither answer guarantees security. Sorry if that was not clear and thanks to @soubunmei and @MichaelHomer for pointing out my careless language. You should talk to a cyber security professional if you believe someone malicious may have attained elevated privileges on the host.
I personally suspect there is a nice "extension and date" based way to do it, as you asked, that some people may find more elegant, but since you already have the list, why not use it?
I tested this on a file named 'list' that contained the lines:
and these files were on my desktop. It worked as expected. I strongly recommend you test this on a small stage first to see how it will behave, and also backup the directory before any mass file removals. Hard drive space is much cheaper than programmers' time!