US Gov confirms PHP2Shell exploitation date?

Polymarket’s “US Gov confirms PHP2Shell exploited by…?” event lists separate October 31 and December 31, 2026 deadlines. In the imported snapshot reviewed on October 23, the quoted Yes probabilities were 90.5% for October and 94% for December. These prices describe trader expectations at that time; they do not establish that CISA has already added either vulnerability to its catalog.

The qualifying event is a CISA KEV addition

Despite the broad wording of the title, the resolution condition is specific. The US Cybersecurity and Infrastructure Security Agency must add CVE-2026-109618 or CVE-2026-109619, the two vulnerabilities identified in the rules as PHP2Shell, to its Known Exploited Vulnerabilities (KEV) Catalog by the relevant deadline at 11:59 p.m. Eastern Time. If that condition is not met, the corresponding contract resolves No.

Either CVE is sufficient; the rules do not require both to appear. They also expressly allow a Yes result if either identifier was already in the catalog when the market was created. The relevant catalog entry’s Date Added determines whether the addition falls within the contract’s timeframe.

General exploitation reports are a different form of evidence

A patch release, a high severity score or a report that a flaw can be exploited does not by itself demonstrate the catalog addition required by this market. Reports of actual attacks may be relevant context, but they must be distinguished from the specified settlement condition. The PHP2Shell nickname alone is also insufficient to identify which CVE a report concerns.

The rules name CISA’s KEV Catalog as the primary resolution source and also permit official CISA announcements and a consensus of credible reporting. Readers assessing settlement should check the exact identifiers, the nature of the evidence and the relevant Date Added rather than treating every government warning as equivalent to a catalog entry.

The deadlines describe cumulative windows

An eligible catalog addition dated on or before October 31 would fall within both listed deadlines. An addition after the October cutoff but by December 31 could satisfy the later contract while leaving the earlier one No. These are separate Yes/No contracts, not mutually exclusive alternatives for the precise date of an addition.

The imported October quote was 3.5 percentage points below the December quote. That difference shows how the two contracts were priced, but it does not establish the pace of CISA’s review or explain why participants traded. There is no verified basis here for asserting that agency processing, a particular incident or an expected announcement caused the gap.

Reading the market snapshot

The event displayed approximately $3.42K in volume, $26.66K in liquidity and $1.84K in open interest in the reviewed import. These trading measures can change and do not confirm an underlying security incident. The final imported deadline is January 1, 2027, at 04:59 UTC, corresponding to December 31 at 11:59 p.m. ET.

The decisive settlement check is whether an eligible KEV entry for either CVE meets the applicable date requirement. This analysis does not independently confirm an existing catalog addition or an exploited system. Source records and the individual contract’s rules should be checked together when determining the result.

Sources

Polymarket market and full rules
CISA Known Exploited Vulnerabilities Catalog