On WordPress sites: update tenweb-speed-optimizer / 10Web Booster to 2.34.11+, or deactivate it until you can. Then search wp-content/uploads (and any custom upload roots the plugin uses) for recently added .php/.phtml/.phar files and review access logs for unauthenticated POSTs to the plugin's REST routes around compressCustom. Patchstack rates this unauthenticated upload as high priority for opportunistic campaigns, so treat internet-facing sites that still show <=2.34.10 as urgent.