Insecure permissions in sites/default/files/php

'sites/default/files/php'

The php folder isn't a default Drupal folder. What is inside it?

Redacted as incorrect information.
There should be a .htaccess file also @ files/.htaccess is it there?

You indicate you are using a distribution. I assume you mean an install profile? If yes, which one?

Drupal 7.5 is 48 releases behind the most stable release. If you are actually using 7.5 (and that isn't a typo), then it's possible that those installs are the security hole and after gaining access someone is tucking folders into your D8 install.

These Twig related files are the cache of compiled Twig templates produced when twig.config:cache:true.
It is the D8 implementation of Twig. Default D8 has cache:true, only advised to set it to false when debugging the templates.

See vendor/twig/twig/lib/Twig/Cache/Filesystem.php function write starting at line 25 for creating the folder and file. It uses 0777 and 0666, hard coded! Note that umask is respected for the file.

public function write($key, $content)
    {
        $dir = dirname($key);
        if (!is_dir($dir)) {
            if (false === @mkdir($dir, 0777, true) && !is_dir($dir)) {
                throw new RuntimeException(sprintf('Unable to create the cache directory (%s).', $dir));
            }
        } elseif (!is_writable($dir)) {
            throw new RuntimeException(sprintf('Unable to write in the cache directory (%s).', $dir));
        }

        $tmpFile = tempnam($dir, basename($key));
        if (false !== @file_put_contents($tmpFile, $content) && @rename($tmpFile, $key)) {
            @chmod($key, 0666 & ~umask());

            if (self::FORCE_BYTECODE_INVALIDATION == ($this->options & self::FORCE_BYTECODE_INVALIDATION)) {
                // Compile cached file into bytecode cache
                if (function_exists('opcache_invalidate')) {
                    opcache_invalidate($key, true);
                } elseif (function_exists('apc_compile_file')) {
                    apc_compile_file($key);
                }
            }

            return;
        }