About This Event

Before Dec 1, 2026 If CISA announces the issuance of an Emergency Directive requiring Federal Civilian Executive Branch agencies to act on the PHP vulnerabilities CVE-2026-109618 or CVE-2026-109619 before Dec 1, 2026, then the market resolves to Yes. An Emergency Directive counts once CISA has published it on its Cybersecurity Directives page. It need not name CVE-2026-109618 or CVE-2026-109619, but its required actions must cover those vulnerabilities in PHP, such as requiring agencies to patch, mitigate, inventory or remove affected PHP systems. A new version of an existing Emergency Directive counts only if that version itself adds required actions covering these vulnerabilities. The following do NOT resolve this market to YES: A Binding Operational Directive. A supplemental direction to an existing Emergency Directive. An addition to the Known Exploited Vulnerabilities catalog, and any remediation deadline that follows from one. A CISA alert, advisory or other guidance urging agencies or the public to patch. A statement that an Emergency Directive is under consideration or forthcoming. This market will close and expire early if the event occurs.