If reading all the PHP stuff is too much, I did a quick podcast yesterday with Ben Harris of @watchtowrcyber explaining what's going on.
https://youtu.be/AkBnlNLbAgY?si=pEJ7eRIP-Iliyg7e