Comment by nightbun

I can almost confirm a Wordpress site I manage was attacked with this. Oct 5th updated it to latest php and Wordpress. Oct 6th it was exploited with a web shell exploit