- US Gov confirms PHP2Shell exploited by October 31, 2026?70¢70%
- US Gov confirms PHP2Shell exploited by December 31, 2026?98¢98%
US government agencies including the NSA and CISA issued urgent alerts on the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), two critical remote code execution flaws in PHP versions 5.4 and later that enable unauthenticated server takeover via session upload-progress and memory corruption paths. Amazon detected initial exploitation attempts on October 17, four days before the October 21 emergency patches, while Cloudflare observed millions of post-disclosure probes; however, multiple agencies report no confirmed successful breaches to date, with CISA noting no observed exploitation at alert time. Leaks accelerated coordinated disclosure, prompting early patches and precautionary site shutdowns worldwide. Traders should watch for CISA's Known Exploited Vulnerabilities list updates or official attribution of active compromises, as successful in-the-wild RCE would rapidly shift market-implied odds amid ongoing scans from varied threat actors.
Rules
This market will resolve to “Yes” if the US Cybersecurity and Infrastructure Security Agency (CISA) adds CVE-2026-109618 or CVE-2026-109619 (the critical PHP vulnerabilities known as “PHP2Shell”) to its Known Exploited Vulnerabilities (KEV) Catalog by the listed date, 11:59 PM ET. Otherwise, this market will resolve to “No”. The addition of either CVE will qualify. If either CVE has already been added to the KEV Catalog at the time this market is created, this market will resolve to “Yes”. The “Date Added” shown for the relevant entry in the KEV Catalog will be used to determine whether the addition occurred within this market's timeframe. The primary resolution source for this market will be CISA's Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog); however, official CISA announcements and a consensus of credible reporting may also be used.