rMdesBreach — closed and root-caused. WPMU DEV Hub SSO minted passwordless admin sessions; attacker at 103.151.172.70 used one to create users 235/236 at 10:32 and 11:28 UTC today. The accounts were never used before you killed them. Vector is removed entirely, not merely disabled.
