I was in a trouble last few days since my web host was hacked for POST on PHP files. I've been dealing with files with .png extension that have PHP code inside.
This is why error checking should be implemented in your upload script, that way, you can test the uploaded file to ensure the data is valid and if the data is not valid, then discard the file and show an error web page.
I can't even try to edit one-by-one to check if it's a valid .png file or not. Is there any way to mass check if a file with a .png is real or fake?
You can make a script that opens each uploaded file and check the first few bytes to ensure the file is valid, but this is an unnecessary step in the future if you decide to add file validation to your upload script like what I described above.
Also, as someone stated in the comments, for at least some protection from script execution, make the upload directory a directory in which the execute bit is not set. Also, make the folder not accessible to the general public so that you can have a chance to validate the files and only make them acceptable to the public when you have validated them.