Another critical PHP security flaw in 2026?

This market will resolve to “Yes” if a critical vulnerability in PHP is first publicly disclosed between market creation and December 31, 2026, 11:59 PM ET, and meets all requirements below by that deadline. Otherwise, this market will resolve to “No”. Public disclosure means publicly available information sufficient to identify the specific vulnerability, whether through an official advisory, researcher publication, leak, or public code commit. A general warning about an unspecified vulnerability will not alone qualify. A vulnerability publicly disclosed before market creation will not qualify merely because it receives a CVE identifier or qualifying score during the market period. A qualifying vulnerability must affect PHP itself (the PHP interpreter and the extensions bundled in the official php-src source code), must be assigned a publicly available CVE identifier, and must receive a publicly published CVSS base score of 9.0 or higher (under any CVSS version) from either the PHP project or the US National Vulnerability Database (NVD). Vulnerabilities affecting only unsupported PHP versions or optional bundled extensions will qualify if they otherwise meet these requirements. Extensions distributed separately from php-src (for example, through PECL) will not qualify. … (condensed)