When will CISA announce the addition of CVE-2026-109618 to the KEV catalog?
Short Answer
CISA is expected to announce the addition of CVE-2026-109618 to the KEV catalog before April 1, 2027, with the market anticipating observed exploitation to emerge by that date despite no current evidence. This outcome is priced at 89.0%, diverging from the model's 74.2%.
1. Market Behavior & Drivers
The market's largest single movement was a 49.0 percentage point spike on October 22. This followed a forecast from Crystal Ball News which predicted CISA would add the critical PHP vulnerability, CVE-2026-109618, to its Known Exploited Vulnerabilities (KEV) catalog before the end of October. The report moved the market's perceived probability from 1.0% to 50.0%.
Subsequent price action reflected conflicting information. A CISA alert, which noted no successful exploitation of the vulnerability had been observed in the wild, coincided with a 28.0 point drop to 22.0% on October 25. Since active exploitation is a key criterion for KEV inclusion, this official statement tempered expectations. However, the market then spiked 44.0 points to 66.0% on October 26, a move for which no specific catalyst appears in the available source material.
- KEV addition before November 1, 2026, is unlikely; CISA stated no observed exploitation.
- The November 15, 2026, threshold carries slightly more probability, offering more time.
- The Before Apr 1, 2027 outcome is most probable, allowing for eventual exploitation evidence.
Who Wins and Why
| Outcome | Market | Model | Why |
|---|---|---|---|
| Before Nov 1, 2026 | 66.0% | 44.0% | CISA has not observed in-the-wild exploitation, a prerequisite, making inclusion by November 1, 2026, unlikely. |
| Before Nov 15, 2026 | 24.0% | 50.4% | Lack of observed exploitation still impacts likelihood, but this date allows more time for evidence to emerge. |
| Before Apr 1, 2027 | 89.0% | 74.2% | CISA announced no observed exploitation as of October 26, 2026, but evidence could emerge over time. |
Current Context
CVE-2026-109618, a critical PHP vulnerability, currently remains outside the KEV catalog. As of October 26, 2026, CVE-2026-109618 is a critical PHP remote-code-execution vulnerability affecting PHP 8.2–8.5 branches, with a CVSS 4.0 score of 9.2 [1][2][3]. CISA urged immediate patching but stated it had not observed successful exploitation in the wild at the time of publication [1]. The latest evidence located does not show CVE-2026-109618 in CISA's KEV catalog; a catalog snapshot dated October 21 contained 1,754 entries and excluded this PHP CVE, while a CISA CSV search shows additions through October 23–26 but no matching entry [4][5][6].
KEV inclusion requires active exploitation evidence, not just high CVSS severity. KEV inclusion depends principally on CISA having reliable evidence of active in-the-wild exploitation plus an available remediation [7][8]. CVSS severity alone does not suffice; an expert also describes CVE assignment and U.S. federal relevance as practical criteria [7][9]. Historical timing evidence suggests new-CVE KEV additions commonly occur quickly once exploitation is confirmed: Barracuda reports a typical gap of approximately nine days, with nearly half of new additions occurring within seven days [10]. The KEV date measures CISA listing rather than attack onset [10]. Developments focus on cybersecurity and exploitation monitoring by CISA, UK NCSC, and security researchers; no credible political factors predict this technical catalog decision [1][4][11][12]. A Coinbase prediction-market event for this CVE's KEV addition before November 1, 2026, lacks a current price or probability, precluding reliable market-implied probability reporting [13].
Addition to KEV by March 31, 2027, holds a 35% probability. If credible exploitation evidence emerges, the most likely announcement window is late October through November 2026, with a secondary risk window in December 2026–January 2027 [1][4][7][10]. Absent such evidence, non-addition before April 1, 2027, is more likely than addition [1][4][7][10]. The point estimate for addition by March 31, 2027, is 35%, with a 65% chance of no addition by that date [1][4][7][10]. If forced to name one expected date conditional on eventual inclusion, the estimate is November 13, 2026, within a broad forecast window of October 30, 2026–January 31, 2027; this reflects an analyst estimate, not a CISA schedule or confirmed prediction-market consensus [1][4][7][10].
Sources (13)
- 1Critical Vulnerabilities in PHP Require Immediate Patching | CISAcisa.gov
- 2NVD-CVE-2026-109618 - NISTnvd.nist.gov
- 3CVE Record: CVE-2026-109618cve.org
- 4Source: CISA Known Exploited Vulnerabilities catalog (JSON feed)php.oct.2026.newsroom.sgit.ai
- 5CVE-2026-109618: OOM bailout during request parsing leads to memoryvulnipulse.com
- 6https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csvcisa.gov
- 7CISA KEV: Catalog Anatomy and How to Integrate It Into Your Patch Management | SecVigilsecvigil.com
- 8CISA KEV catalog: a working sysadmin's guide to actually using it — WPSwps.hkprog.org
- 9New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA's KEV Catalog - SecurityWeeksecurityweek.com
- 10The KEV gap: how fast do exploited bugs get flagged? | Barracuda Networks Blogfr.blog.barracuda.com
- 11Critical security issue affecting PHPncsc.gov.uk
- 12CVE Index | RedEye Security Threat Intelligencethreat-intelligence.redeyesecurity.com
- 13When will CISA announce the addition of CVE-2026-...coinbase.com
2. Price Chart
Historical Price (Probability)
Outcome probability
Date
3. Significant Price Movements
Notable price changes detected in the chart, along with research into what caused each movement.
📈 October 26, 2026: 78.0pp spike
Price increased from 11.0% to 89.0%
Outcome: Before Apr 1, 2027
What happened: No specific social media activity or traditional news announcement from the provided sources explains the 78.0 percentage point price spike on October 26, 2026. The research explicitly states that "news/social-media catalyst do not appear in the cited CISA, NVD, CVE, or UK NCSC evidence" for this market movement [1][2][3]. While a third-party record asserted exploitation of CVE-2026-109618 on October 21, 2026, it also noted the vulnerability was not yet in the CISA KEV [4], and CISA's alert on the same day reported no observed exploitation [2]. Therefore, social media was irrelevant to this market movement based on the available information.
📉 October 25, 2026: 70.0pp drop
Price decreased from 81.0% to 11.0%
Outcome: Before Apr 1, 2027
What happened: The primary driver of the 70-percentage-point price drop was CISA's official alert on October 21, 2026, which announced critical PHP vulnerabilities but explicitly stated no successful exploitation of CVE-2026-109618 had been observed in the wild [2]. Since CISA adds vulnerabilities to its KEV catalog when there is evidence of active exploitation, this official announcement significantly reduced the likelihood of CVE-2026-109618 being added before April 1, 2027 [2]. This traditional news release, preceding the market movement, appears to be the main factor influencing the outcome. Social media activity was irrelevant, as no related posts or narratives are evidenced in the provided sources.
📈 October 22, 2026: 75.0pp spike
Price increased from 5.0% to 80.0%
Outcome: Before Apr 1, 2027
What happened: The primary driver of the 75.0 percentage point price spike on October 22, 2026, appears to be a traditional news forecast published that day by Crystal Ball News (detectium.io) [5]. This forecast predicted that CISA would add the critical PHP flaw (CVE-2026-109618) to its exploited-bug list before December, offering a point estimate of November 2026, which directly supports the market's "Before Apr 1, 2027" outcome [5]. This forecast coincided with the market movement, despite CISA's October 21 alert stating no observed successful exploitation in the wild at that time [2]. Social media was irrelevant, as no relevant posts or narratives from key figures were identified in the provided sources.
Sources (5)
- 1Known Exploited Vulnerabilities Catalog | CISAcisa.gov
- 2Critical Vulnerabilities in PHP Require Immediate Patching | CISAcisa.gov
- 3CISA Adds Six Known Exploited Vulnerabilities to Catalog | CISAcisa.gov
- 4KEV Entry: CVE-2026-109618db.gcve.eu
- 5Forecast: US puts a critical PHP flaw on its exploited-bug list before December | Crystal Ball Newsnews.detectium.io
4. Market Data
Contract Snapshot
This market resolves to "Yes" if the Cybersecurity and Infrastructure Security Agency (CISA) announces the addition of CVE-2026-109618 to the KEV (Known Exploited Vulnerabilities) catalog before November 1, 2026. Conversely, it resolves to "No" if this announcement is not made by the stated deadline. No other special settlement conditions for the market's resolution are detailed in the provided content.
Available Contracts
Market options and current pricing
| Outcome bucket | Yes (price) | No (price) | Last trade probability |
|---|---|---|---|
| Before Nov 1, 2026 | $0.69 | $0.33 | 66% |
| Before Nov 15, 2026 | $0.78 | $0.31 | 24% |
| Before Apr 1, 2027 | $0.93 | $0.16 | 89% |
Market Discussion
CISA's Known Exploited Vulnerabilities (KEV) catalog, as of version 2026.10.21, does not contain CVE-2026-109618 [1]. CISA published an alert page on 2026-10-23 urging immediate patching for this vulnerability, noting that no successful exploitation had been observed as of the time of publication [2]. Despite this, a prediction market currently prices a 66% expectation that CISA will announce the addition of CVE-2026-109618 to the KEV catalog before Nov 1, 2026 [3].
5. Trust Index
Largest single print on KXPHPKEV-26OCT-26NOV01 carried 47% of its $800 tape (window is 100% of 24h flow)
Integrity risk· Large trades
How it adds up
Integrity80% of score77Good
Market integrity is low (65), but Integrity averages all three scores, so the other two pull it up. Only a critically low score would cap the total.
Trade quality20% of score52Caution
Includes the cost to trade: a $1,000 order can't be filled here because the order book is too thin.
Trust score72Good
Weighted blend with hard caps — a critically weak safety pillar, or a severe trading anomaly, caps the total regardless of the rest. Full methodology · About the Trust Index
Trust profile
Integrity4 screens run · 6 don't apply
6. Besides a lack of exploitation evidence, what other factors could delay or prevent CISA from adding CVE-2026-109618 to the KEV catalog before April 2027?
| KEV Addition Delay Factors | Further research, insufficient evidence, unavailable mitigations, additional concerns, or unassigned CVE [1] |
|---|---|
| KEV Inclusion Condition | Clear remediation or mitigation [1] |
| CVE-2026-109618 Exploitation Status | Not observed successful exploitation at time of publication [2] |
CISA considers several factors for KEV catalog inclusion. Beyond a lack of observed exploitation, CISA identifies several factors that can delay or prevent adding a Common Vulnerabilities and Exposures (CVE) to its Known Exploited Vulnerabilities (KEV) catalog before specific deadlines like April 2027. These factors include needing further research, having insufficient evidence, the unavailability of mitigations, additional concerns, or an unassigned CVE. A critical prerequisite for KEV inclusion is the availability of clear remediation or mitigation, meaning that missing or uncertain remediation timelines can also delay the addition of an otherwise exploitable CVE [1].
CVE-2026-109618 currently lacks observed exploitation evidence. A CISA-issued alert regarding CVE-2026-109618 indicated that successful exploitation had not been observed at the time of publication, illustrating how evidence thresholds may lag initial vulnerability announcements [2]. It is important to note that the high implied likelihood of a KEV announcement by April 1, 2027, from prediction markets does not constitute an evidence-based mechanism for KEV delays. Such market predictions exist independently of CISA's official process blockers [3], [1].
7. As of late October 2026, what is the official status of CVE-2026-109618 in the CISA KEV catalog and the NIST National Vulnerability Database?
| CISA KEV Catalog Status (Late Oct 2026) | Not yet added [1][2] |
|---|---|
| NVD Record Status (Late Oct 2026) | Available and updated [3] |
| Kalshi Prediction for KEV Addition | 89% for "Before Apr 1, 2027" [4] |
As of late October 2026, CVE-2026-109618 was not listed in the CISA KEV catalog. The CISA Known Exploited Vulnerabilities (KEV) catalog did not yet contain an entry for CVE-2026-109618 [1][2]. Despite its absence from the KEV catalog, CISA released an alert on October 21, 2026, advising immediate patching for various PHP vulnerabilities, specifically mentioning CVE-2026-109618 [1]. Subsequent reports dated October 23, 2026, also indicated that the KEV catalog still did not contain this vulnerability [1][2].
The NIST NVD provides a detailed record for CVE-2026-109618. In contrast to the CISA KEV catalog, the NIST National Vulnerability Database (NVD) maintained an active record for CVE-2026-109618 during the same timeframe [3]. This NVD record was initially published on October 21, 2026, and underwent its most recent modification on October 26, 2026 [3]. Looking forward, the Kalshi prediction market assigns an 89% probability that CVE-2026-109618 will be added to the CISA KEV catalog prior to April 1, 2027 [4].
8. How does CVE-2026-109618 compare to its companion, CVE-2026-109619, in terms of severity and potential for exploitation?
| Severity (CVE-2026-109618/109619) | Critical, CVSS v4.0 score of 9.2 [1][2][3] |
|---|---|
| Outcome | Unauthenticated Remote Code Execution (RCE) [1][4][3][5][6] |
| Fixed PHP Versions | 8.5.12, 8.4.27, 8.3.36, 8.2.35 [1][4][3][5][6] |
Their exploitation mechanisms, while both leading to RCE, differ significantly. Exploitation for CVE-2026-109618 involves Out-Of-Memory (OOM) corruption during request parsing, requiring specific conditions such as heap manipulation and precise timing to achieve RCE [1][3]. In contrast, CVE-2026-109619 is linked to stale global state or Use-After-Free (UAF)-style behavior across requests, with its RCE exploitation dependent on particular affected state, configuration, or application behavior [1][3].
Ranking their exploitation potential is currently not possible, but patching is vital. Based on available information, it is not possible to comparatively rank which vulnerability has a higher or lower potential for exploitation, beyond noting their distinct contextual requirements [1][4][3][5][6]. Public advisories strongly recommend immediate patching for both vulnerabilities to fixed PHP versions, including 8.5.12, 8.4.27, 8.3.36, and 8.2.35 [1][4][3][5][6].
Sources (6)
- 1Responding to core PHP vulnerabilities CVE-2026-109618...cloud.google.com
- 2CVE-2026-109618 Detail - NVDnvd.nist.gov
- 3oss-security - CVE-2026-109619: PHP 8.2–8.5 RCE via stale global stateopenwall.com
- 4CVE-2026-109618access.redhat.com
- 5Critical Vulnerabilities in PHP (PHP2Shell)digital.nhs.uk
- 6PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619...watchtowr.com
9. Based on historical 2024-2026 data, what is the typical timeline between confirmed 'in-the-wild' exploitation of a new CVE and its addition to CISA's KEV catalog?
| Median CVE publication to KEV listing (2026) | 5 days [1] |
|---|---|
| CVEs added on publication day or earlier (Apr-Sep 2026) | 20% [1] |
| Exploitation to KEV listing (max observed) | Nearly 10 months [2] |
The available data does not provide a specific "typical" timeline directly measuring the interval between confirmed 'in-the-wild' exploitation and its addition to CISA's KEV catalog for the overall 2024-2026 period [2]. The provided research focuses on the timeline from CVE publication to KEV listing and specific instances of multi-month delays for exploitation to KEV listing.
CVE publication to KEV listing shows a faster cadence. For instance, the median time from CVE publication to its listing in the KEV catalog was 5 days in 2026 [1]. Furthermore, during April to September 2026, 20% of listed CVEs were added to the KEV catalog on the same day as their publication or even earlier, which suggests a faster listing cadence for newer CVEs [1].
Exploitation to KEV addition can take several months. In contrast to the quick CVE publication to KEV listing, the timeline from confirmed 'in-the-wild' exploitation to KEV addition can be significantly longer, extending to several months [2]. Some reports illustrate cases where entries were added to the KEV catalog nearly 10 months after exploit or Proof-of-Concept activity was observed [2].
10. What are CISA's official criteria for adding a vulnerability like CVE-2026-109618 to the KEV catalog?
| CVE ID Requirement | Must have an assigned CVE ID [1] |
|---|---|
| Exploitation Evidence | Reliable evidence of active exploitation in the wild [1] |
| Remediation Action | Clear remediation action required [1] |
CISA's Known Exploited Vulnerabilities (KEV) catalog includes vulnerabilities meeting specific criteria. CISA maintains an explicit policy outlining three specific criteria for adding vulnerabilities to its KEV catalog [1]. These criteria are designed to ensure that the catalog exclusively lists vulnerabilities that are actively exploited in the wild and for which a remediation is readily available [1].
Inclusion requires a CVE ID, active exploitation, and remediation. To be added to the KEV catalog, a vulnerability must first possess an assigned CVE ID [1]. Secondly, reliable evidence demonstrating active exploitation of the vulnerability in the wild is mandatory; mere scanning, research, or proof-of-concept demonstrations are not sufficient on their own [1]. Finally, a clear and defined remediation action, such as a vendor-provided update, must be available for the vulnerability to be included in the catalog [1].
11. What Could Change the Odds
Key Catalysts
As of the October 21, 2026 KEV catalog release, CVE-2026-109618 was not present in CISA's Known Exploited Vulnerabilities catalog [1][2]. CISA's October 21, 2026 alert for CVE-2026-109618 and CVE-2026-109619 stated CISA had not observed successful exploitation at the time of publication [3]. By the morning of October 26, 2026, CISA had not added the vulnerabilities to the KEV catalog [4].
Key Dates & Catalysts
- Expiration: October 30, 2026
- Closes: April 01, 2027
Sources (5)
- 1Source: CISA Known Exploited Vulnerabilities catalog (JSON feed)php.oct.2026.newsroom.sgit.ai
- 2Known Exploited Vulnerabilities Catalog | CISAcisa.gov
- 3Critical Vulnerabilities in PHP Require Immediate Patching | CISAcisa.gov
- 4PHP2Shell Exploitation Moves From Probes to Working Shells - SecurityWeeksecurityweek.com
- 5When will CISA announce the addition of CVE-2026-109618 to the KEV catalog? Odds & Predictionskalshi.com
13. Related News
14. Historical Resolutions
Historical Resolutions: 2 markets in this series
Outcomes: 0 resolved YES, 2 resolved NO
Recent resolutions:
- KXPHPKEV-26OCT-26OCT26: NO (Oct 26, 2026)
- KXPHPKEV-26OCT-26OCT23: NO (Oct 23, 2026)
