Has there yet been any signs of any service actually being successfully hacked due to the vulnerability?

I'd expect agents to be hacking hundreds of thousands of websites as we speak.

They'll of course install a backdoor and patch the exploit so others can't come in. They won't deface the website, so there won't be signs.

Watchtowr reports yes, but doesn't say where exactly right now: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/#...