Themes whose banner you can google for. If those sites have pearcmd.php is available, they're using the official Docker php image, and/or using default cPanel, the site is vulnerable, afaict. Basically a drive-by exploit for anyone with some google-fu.