The person who wrote the widely-referred-to tweet last night (claiming to "have recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619") followed up a couple hours later and said that their POC had not been proven to work "in the wild"
As far as i know they lied and are now retracting their claims. What they posted was not consistent with the details of the real bug.
The whole post looked to be vibecoded and the code did not even match the claims