Will America's cyber agency say the third flaw under most websites is being used in real attacks, by Nov 14?

Call opened Nov 1, 2026 · days to weeks · the question's wording never changes after it is published
Open · resolves Nov 14, 2026

The index says: very unlikely (15%). Graded on that date, right or wrong, in public.

The incident: PHP2Shell: AI-found PHP flaws leak, trigger global shutdowns · Who is involved: CISA (America's cyber agency)

Why the index thinks so

PHP says the bug needs an unusual session configuration and no exploitation has been reported; CISA lists only flaws with evidence of real attacks. It listed the other two within five days of their fix.

What would move it

The CISA KEV feed; any report of the third bug used in real attacks.

The exact question: CISA adds CVE-2026-115560, the third PHP bug, to its Known Exploited Vulnerabilities catalog by Nov 14

Proof it was called in advance

  • Published Nov 1, 2026; first recorded in the odds ledger Nov 1, 2026, 06:00 ET.
  • The commit that added it: dfcb13205f, Nov 1, 2026 (public, timestamped history).
  • Fingerprint of the exact wording (SHA-256): fb8417ddec0865b7200f261736a21e35cd9ba35e91d5bac920cace7b3c53b8bb. Anyone can hash the question below and get the same string; any edit would change it.

How the odds moved

WhenThe index's odds
Nov 1, 2026, 06:00 ET15%

Why each move happened is in the changelog.

Every forecast and the track record →