Comment by tikotus
8 hours ago
Has there yet been any signs of any service actually being successfully hacked due to the vulnerability?
8 hours ago
Has there yet been any signs of any service actually being successfully hacked due to the vulnerability?
I'd expect agents to be hacking hundreds of thousands of websites as we speak.
They'll of course install a backdoor and patch the exploit so others can't come in. They won't deface the website, so there won't be signs.
Watchtowr reports yes, but doesn't say where exactly right now: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/#...
Well they did specify "successfully." EITW is a pretty broad tag, just means attacker are probing servers. I'm not saying it's good but there are usually some pretty big caveats with remote-remote memory corruption, don't know if all the people dooming are aware of that
> Exploit portability and reliability depend on the PHP build, extensions, frontend behavior and allocator layout.
This is the real question here. So much panic right now.