I'd expect agents to be hacking hundreds of thousands of websites as we speak.

They'll of course install a backdoor and patch the exploit so others can't come in. They won't deface the website, so there won't be signs.

Watchtowr reports yes, but doesn't say where exactly right now: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/#...

This is the real question here. So much panic right now.