The person who wrote the widely-referred-to tweet last night (claiming to "have recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619") followed up a couple hours later and said that their POC had not been proven to work "in the wild"

[0] https://x.com/J4ck3LSyN/status/2112703096443097263

[1] https://x.com/J4ck3LSyN/status/2112753673235501137