Malicious PHP files

So yesterday, my website got a malicious php file and the wp-load.php file was modified. This is the file added to one of the theme folders:

contt-logos.php

All of my plugins and WordPress Core are up to date. This morning, the same file showed up again, and the wp-load.php got modified with a string again. I’m reporting this here in case this may be a vulnerability within the core, but I don’t know what the problem is.