I'd expect agents to be hacking hundreds of thousands of websites as we speak.
replyThey'll of course install a backdoor and patch the exploit so others can't come in. They won't deface the website, so there won't be signs.
Watchtowr reports yes, but doesn't say where exactly right now: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/#...
replyWell they did specify "successfully." EITW is a pretty broad tag, just means attacker are probing servers. I'm not saying it's good but there are usually some pretty big caveats with remote-remote memory corruption, don't know if all the people dooming are aware of that
reply> Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout.
This is the real question here. So much panic right now.
reply