a little late but,
attackers hitting wordpress SSO plugins drop a web shell called thoms.php. alex thomas from wordfence wrote the advisory. a bit funny tbh.miniOrange SAML + WPMU DEV Hub SSO, both unauthenticated admin.update or remove SSO using plugins. then grep for "Nx-zD".