- 美国政府会在2026年10月31日前确认 PHP2Shell 遭到利用吗？55¢55%
- 美国政府会在2026年12月31日前确认 PHP2Shell 遭到利用吗？97¢97%
US government agencies including the NSA and CISA issued urgent alerts on the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), two critical remote code execution flaws in PHP versions 5.4 and later that enable unauthenticated server takeover via session upload-progress and memory corruption paths. Amazon detected initial exploitation attempts on October 17, four days before the October 21 emergency patches, while Cloudflare observed millions of post-disclosure probes; however, multiple agencies report no confirmed successful breaches to date, with CISA noting no observed exploitation at alert time. Leaks accelerated coordinated disclosure, prompting early patches and precautionary site shutdowns worldwide. Traders should watch for CISA's Known Exploited Vulnerabilities list updates or official attribution of active compromises, as successful in-the-wild RCE would rapidly shift market-implied odds amid ongoing scans from varied threat actors.
规则
如果美国网络安全和基础设施安全局（CISA）在所列日期 23:59 ET 前，将 CVE-2026-109618 或 CVE-2026-109619（被称为“PHP2Shell”的 PHP 严重漏洞）添加到其已知遭利用漏洞（KEV）目录，本市场将结算为“是”。否则，此市场将判定为“否”。 添加任一 CVE 即符合条件。如果在创建本市场时，任一 CVE 已添加到 KEV 目录，本市场将结算为“是”。 将以 KEV 目录中相关条目显示的“Date Added”日期，判断该条目是否在本市场的时间范围内添加。 本市场的主要结算来源为 CISA 的已知遭利用漏洞目录（https://www.cisa.gov/known-exploited-vulnerabilities-catalog）；但也可参考 CISA 官方公告以及可信报道的共识。
机器翻译。如有争议，以原文为准。