A customer site on 8.9.6 got a virus scan alert when Apache 2.4 dropped a file in the Windows Temp folder, which is where Drupal has set tmp files to go.
Looking at the logs, this is the only successful POST I find:
"POST /index.php?s=captcha HTTP/1.1" 200
And its payload, removed:
C:\Windows\Temp\phpF0CC.tmp
Was this a precursor to the file upload attack that would have been resolved by core 8.9.9 ? This occured well before the security advisory was posted for it.
None of the intermediate core updates were a security concern.