I'd expect agents to be hacking hundreds of thousands of websites as we speak.

They'll of course install a backdoor and patch the exploit so others can't come in. They won't deface the website, so there won't be signs.

Watchtowr reports yes, but doesn't say where exactly right now: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/#...

Well they did specify "successfully." EITW is a pretty broad tag, just means attacker are probing servers. I'm not saying it's good but there are usually some pretty big caveats with remote-remote memory corruption, don't know if all the people dooming are aware of that

> Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout.

This is the real question here. So much panic right now.