Resolved Markets

Will Artifactory backdoor campaign compromise 10+ organizations by Oct 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline (Oct 11, 2026) has passed. Today is Oct 13, 2026. No credible evidence of 10+ confirmed organizational compromises via Artifactory backdoor has been publicly disclosed by JFrog, CISA, or security researchers. The initial Bleeping Computer report documented the vulnerability and attack campaign, but no follow-up disclosures confirm the 10+ compromise threshold specified in the resolution criteria.

Will CVE-2026-35273 PeopleSoft WAF-bypass exploitation be documented by Oct 11?

[Auto-closed — deadline passed with no qualifying event] Deadline has passed (Oct 11, 2026; today is Oct 12, 2026). No public documentation from CISA, vendor advisories, or security research disclosing ShinyHunters or similar actors exploiting CVE-2026-35273 with WAF-bypass techniques has emerged in the recent intelligence feed or public sources. The initial Bleeping Computer report (Sept 27) documented the vulnerability and threat actors' interest, but no subsequent exploitation documentation meeting resolution criteria was disclosed by the deadline.

Will OpenAI's 'recurrent depth' reasoning technique in Astra be independently documented as introducing safety risks by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline passed (Oct 3, 2026). No peer-reviewed publications, official AI safety lab reports, or reputable documented analysis of 'recurrent depth' introducing specific measurable safety/alignment risks has emerged. Recent intel shows general AI safety concerns at Anthropic and OpenAI but no documentation matching the resolution criteria.

Will passkey-phishing campaigns compromise 50+ M365 accounts by Oct 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline was 2026-10-02. Today is 2026-10-04 (deadline has passed). The resolution criteria required public disclosure by Microsoft, security researchers, or law enforcement confirming 50+ documented account compromises attributed to passkey-phishing campaigns by the deadline. No such public disclosure confirming 50+ compromise cases exists in available evidence.

Will Anthropic formally document Chinese AI distillation IP theft by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline was 2026-10-02. Today is 2026-10-04 (deadline has passed). No public disclosure, blog post, or advisory from Anthropic formally documenting Chinese AI distillation IP theft has been identified in the recent intel or available sources. The market description references a TechCrunch AI report, but no corroborating Anthropic formal disclosure is present in the intelligence batch.

Will CrowdStrike FalconFlank zero-day (CVE-TBD) be added to CISA KEV by end of Sept 2026?

Deadline was 2026-10-02. Today is 2026-10-04 (deadline has passed). CISA's most recent KEV additions posted on 2026-10-02 included CVE-2026-102489 and CVE-2026-102490 (Zammad vulnerabilities), but no FalconFlank or related CrowdStrike zero-day CVE was added. No CISA advisory or KEV catalog entry for FalconFlank exists in available evidence.

Will PaperCut NG/MF zero-day be added to CISA KEV by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution required CVE(s) associated with the PaperCut NG/MF zero-day to appear in CISA's Known Exploited Vulnerabilities catalog by Sept 30, 2026, confirmed by official CISA KEV listing. Recent CISA alerts reviewed do not include PaperCut NG/MF CVE in newly published KEV entries. CISA's latest bulletin (Oct 2) lists Zammad CVEs and other vulnerabilities but not PaperCut.

Will CrowdStrike FalconFlank zero-day be added to CISA KEV by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution required CISA to add the FalconFlank zero-day or related CrowdStrike Falcon privilege-escalation CVE to the Known Exploited Vulnerabilities catalog by Oct 1, 2026, confirmed by official CISA advisory or vendor security notice. Recent CISA alerts reviewed (Oct 2-4) do not include CrowdStrike Falcon or FalconFlank in newly added KEV entries. CISA's latest KEV additions from Oct 2 include Zammad vulnerabilities, not CrowdStrike.

Will Bransys ELD CVEs (CVE-2026-86520/86689/77960) be actively exploited by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution required public evidence from security vendors, CISA KEV entries, threat intelligence reports, or independent researchers documenting active exploitation of one or more of the three Bransys ELD CVEs (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960) by Sept 30. Recent CISA alerts reviewed do not include evidence of exploitation for these specific CVEs. Recent alerts cover other IoT/industrial control systems (Johnson Controls, Meari, Monta) but not Bransys ELD active exploitation.

Will Metabase SQLi zero-day PoC be publicly released by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution required credible PoC, functional exploit code, or detailed technical breakdown of the Metabase SQLi zero-day published in public repository, blog, or advisory by Sept 30, 2026, confirmed via CISA, security media, or Metabase advisory. Recent intelligence does not document public release of PoC or detailed technical exploitation details. No Metabase advisory, CISA alert, or security research confirming public PoC release appears in recent intel.

Will the SharePoint RCE chain PoC be publicly released by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution required public PoC or working exploit code for the two-CVE SharePoint RCE chain, confirmed via Bleeping Computer, Defused blog, Microsoft advisory, security researcher channels, or CISA. Recent intelligence does not document public release of PoC or exploit code for this specific two-vulnerability chain. Recent alerts cover other vulnerabilities (Johnson Controls, Meari IoT, Monta) but not SharePoint RCE chain exploitation.

Will OpenAI formally disclose details of RubyGems AI agent attack and remediation by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution required OpenAI to publish an official statement, security advisory, or incident report detailing the RubyGems attack, scope, affected users, and remediation via OpenAI official channels, CISA advisories, or credible media citing direct OpenAI confirmation. Recent intelligence includes OpenAI agent announcements (Dots platform) and a safety employee resignation/criticism, but no official OpenAI disclosure of the RubyGems attack, details, or remediation. The market description references researcher reports but not an official OpenAI statement as required.

Will Anthropic Claude watermark be circumvented or disabled by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution required peer-reviewed or credible independent security report demonstrating reliable watermark removal/bypass, Anthropic acknowledging the weakness, or practical attack widely documented in reputable infosec venues. Recent intelligence includes Anthropic requesting voice data from Claude users (unrelated to watermark security) but no credible reports of watermark circumvention, bypass techniques, or security research demonstrating watermark failure. No evidence from security researchers, Anthropic, or infosec publications documenting watermark defeat.

Will autonomous AI-agent cyberattacks using DeepSeek be documented in 5+ incidents by end of 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-10-01. Today is 2026-10-04 (3 days past deadline). Resolution criteria required 5+ separate documented incidents of autonomous or semi-autonomous cyberattacks using DeepSeek or similar open agentic LLMs, confirmed by vendor advisories, CISA, or reputable cybersecurity publications. Recent intelligence discusses AI agents in general (Google Gemini, OpenAI Dots, text message agents) but does not document 5 distinct DeepSeek-specific offensive incidents meeting the criteria. No CISA KEV entries or vendor advisories for DeepSeek-based attacks appear in recent intel.

Will CVE-2026-85706 (GitLab path traversal) lead to 5+ documented exploitation incidents by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-09-30. Today is 2026-10-04 (4 days past deadline). The resolution criteria required 5 or more distinct documented exploitation incidents of CVE-2026-85706 (GitLab path traversal) confirmed via CISA advisories, vendor bulletins, threat intelligence, or breach disclosures by end of September. No recent intelligence shows 5+ documented incidents meeting this threshold. Recent CISA alerts reviewed contain only two new KEV entries (Zammad CVEs), not the required GitLab CVE documentation.

Will Anthropic formally acknowledge system-wide guardrail failures enabling model hacking by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-09-30. Today is 2026-10-04 (4 days past deadline). No credible evidence of Anthropic issuing a formal acknowledgment, official statement, or incident report detailing systemic guardrail failures that enabled unauthorized cyberattacks. Recent intel includes OpenAI safety employee resignation and general AI governance discussions, but nothing from Anthropic confirming the specific claim in the market. The absence of any qualifying event by the stated deadline constitutes resolution.

Will phishing campaigns targeting AI service users (ChatGPT, Claude) result in 100+ documented compromised accounts by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] The market deadline was 2026-10-02. Today is 2026-10-03 (past deadline). No public disclosure from SANS, Proofpoint, Cloudflare, or CISA documenting 100+ verified compromised AI-service accounts from phishing campaigns has appeared in recent intel. The deadline has passed with no qualifying event.

Will Johnson Controls C-CURE RCE vulnerability be actively exploited before Sept 2026?

[Auto-closed — deadline passed with no qualifying event] The market deadline was 2026-10-01. Today is 2026-10-03 (past deadline). No credible evidence of CISA KEV addition, vendor confirmation, or public disclosure of active RCE exploitation of Johnson Controls C-CURE vulnerabilities has appeared. The deadline has passed with no qualifying event.

Will Johnson Controls Airwall vulnerability lead to documented exploitation by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] The market deadline was 2026-10-01. Today is 2026-10-03 (past deadline). No credible public evidence of documented exploitation of Johnson Controls Airwall vulnerability has been found in available intel sources. The deadline has passed with no qualifying event.

Will CrowdStrike FalconFlank exploit be used in active attacks by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] The market deadline of 2026-10-01 has passed (today is 2026-10-02). No credible evidence from CISA, CrowdStrike, Mandiant, or reputable security vendors documenting active exploitation of the CrowdStrike FalconFlank zero-day in APT intrusions or via confirmed use in field attacks has been identified in recent threat intelligence.

Will Microsoft Entra ID max-severity flaw be added to CISA KEV by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). No evidence in the provided recent intelligence confirms that CISA added an Entra ID flaw to the KEV Catalog with confirmation of active exploitation by the deadline. While Fortinet FortiMail is the only vulnerability added to CISA KEV in the recent intelligence, no Entra ID entry is mentioned.

Will PaperCut NG/MF zero-day exploits (CVE-2026-81578, CVE-2026-82078) lead to 10+ documented data theft incidents by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). No public disclosure from victim organizations, incident response reports, or threat intelligence vendors documenting at least 10 distinct PaperCut data-theft incidents using CVE-2026-81578 or CVE-2026-82078 was found in the provided intelligence.

Will Rockwell Automation OTTO Fleet Manager weak password hashing be actively exploited by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). No public documentation from CISA KEV, vendor advisories, or security researchers confirming active exploitation (successful brute-force attacks, credential compromise, or malware samples) of Rockwell Automation OTTO Fleet Manager password hash weakness was found in the provided intelligence.

Will Xiiaozet LK100W devices be actively exploited via CVE-2026-78037/78239/76943 by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). No public documentation from CISA KEV, vendor advisories, or security researchers confirming active exploitation (PoC, malware samples, or victim reports) of CVE-2026-78037, CVE-2026-78239, or CVE-2026-76943 in Xiiaozet LK100W devices was found in the provided intelligence.

Will Microsoft Defender ShieldCrash zero-day be added to CISA KEV by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). No evidence in the provided recent intelligence confirms that CISA added ShieldCrash or a Microsoft Defender zero-day CVE to the Known Exploited Vulnerabilities Catalog by the deadline.

Will Siemens SICAM 8 vulnerability be added to CISA KEV by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). The recent intelligence provided contains no confirmation that Siemens SICAM 8 vulnerabilities were added to the CISA KEV catalog by the deadline. No CVE entries for Siemens SICAM 8 appear in the provided recent threat intelligence.

Will CrowdStrike FalconFlank zero-day lead to 10+ documented exploitations by Sept 30, 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). No public reports from CISA, CrowdStrike, security researchers, or threat intelligence providers documenting 10+ distinct exploitation incidents of the CrowdStrike FalconFlank zero-day were found in the provided intelligence.

Will MLflow vulnerability be added to CISA KEV by end of September 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline of 2026-09-30 has passed (today is 2026-10-02). No CISA KEV entry for MLflow vulnerability was found in the recent intelligence provided or confirmed by the deadline. The absence of a CISA KEV catalog entry by the deadline means the market condition was not met.

Will SIMATIC S7-PLCSIM Advanced DoS vulnerability be added to CISA KEV by end of 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline has passed (2026-09-26, today is 2026-09-27). No evidence of SIMATIC S7-PLCSIM Advanced vulnerability being added to CISA KEV catalog or vendor advisory confirming in-the-wild exploitation.

Will GPUThor Rowhammer attack achieve documented root-level GPU compromise by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline has passed (2026-09-26, today is 2026-09-27). No credible public evidence of documented GPUThor root-level GPU compromise, CVE, NVIDIA advisory, or peer-reviewed research confirming exploitability on production hardware.

Will MLflow vulnerability be added to CISA KEV by September 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-09-20 (2 days ago as of today 2026-09-22). No CISA KEV addition or authoritative vendor confirmation of active exploitation has been documented in recent intel or public sources.

Will CrowdStrike FalconFlank be actively exploited in the wild by Sept 15, 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline has passed (Sept 15, 2026 was yesterday; today is Sept 16, 2026). No credible evidence in recent intel feeds confirms active in-the-wild exploitation of CrowdStrike FalconFlank. Despite public PoC availability, the absence of CISA advisories, vendor confirmation, VirusTotal detections, or threat intelligence reports by the deadline indicates no qualifying exploitation occurred.

Will Siemens Mendix Runtime CVE be actively exploited by end of 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline is 2026-09-11 (today is 2026-09-12, deadline has passed). Recent CISA alerts from 2026-09-11 show additions of CVE-2026-42016, CVE-2026-42018 (JFrog Artifactory), and CVE-2026-85706 (GitLab), but no mention of Siemens Mendix Runtime vulnerability being added to CISA KEV. No security firm reports, vendor advisories, or exploitation documentation for this Siemens Mendix vulnerability are present in the recent intelligence batch.

Will Anthropic's 1Password integration for Claude be patched or revoked by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline 2026-08-31 has passed (today is 2026-09-03). No evidence in recent intel of Anthropic or 1Password announcing removal, disabling, patching, or deprecation of the 1Password-Claude integration.

Will GPT-5.6 Sol's unauthorized file-deletion bug be publicly confirmed by Aug 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline 2026-08-31 has passed (today is 2026-09-03). No credible evidence found in recent intel of public confirmation from OpenAI, CISA, or major security research organization that GPT-5.6 Sol's file-deletion behavior is a reproducible bug vs. expected model behavior.

Will PaperCut NG/MF zero-day be added to CISA KEV by Sept 2026?

CISA has officially added two PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-81578 (Missing Authentication for Critical Function) and CVE-2026-82078 (Unsafe Reflection). This directly satisfies the market resolution criteria. Additionally, Bleeping Computer confirms recent patched PaperCut zero-days are being used in data theft attacks.

Will CL0P ransomware conduct a new mass exploitation campaign using a zero-day vulnerability in 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline (2026-08-31) has passed. No public claims from CL0P or credibly CL0P-affiliated groups regarding a new mass exploitation campaign leveraging a zero-day vulnerability, and no evidence of 10+ victim organizations being targeted, appears in recent threat intelligence as of 2026-09-01.

Will the fake Claude SectopRAT malvertising campaign infect 500+ systems by end of August 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline (2026-08-31) has passed. No public reporting from Bleeping Computer, Malwarebytes, antivirus vendors, or CISA confirming 500+ systems infected with SectopRAT via the fake Claude malvertising campaign has been found in recent intelligence or authoritative sources as of 2026-09-01.

Will the Windows LegacyHive zero-day be actively exploited in the wild by end of August 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline (2026-08-31) has passed with no credible public evidence of active wild exploitation of Windows LegacyHive zero-day. No CISA KEV addition, Microsoft advisory, or security vendor confirmation of exploitation documented in recent intelligence.

Will attackers successfully compromise AI credentials or MCP systems via scanning campaign by Sept 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-08-28 (today is 2026-08-30). No publicly disclosed breach or compromise of AI credentials/MCP systems linked to the scanning campaign has been reported as of the deadline date. The recent intel batch contains no relevant reporting on successful compromises from this campaign.

Will CVE-2026-73570 (Zimbra ZCS) be exploited in 5+ documented incidents by end of Sept 2026?

CISA officially added CVE-2026-73570 (Zimbra Collaboration Suite OS Command Injection Vulnerability) to the KEV Catalog on August 25, 2026, confirming active exploitation as of the stated deadline.

Will CVE-2026-21962 (Oracle WebLogic Proxy) lead to documented enterprise breach by Sept 2026?

CISA officially added CVE-2026-21962 (Oracle HTTP Server and WebLogic Server Proxy Plug-in Improper Access Control Vulnerability) to the Known Exploited Vulnerabilities (KEV) Catalog on August 25, 2026 (today), confirming active exploitation.

Will SonicWall SMA1000 zero-day exploits lead to documented critical breach by mid-August 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline 2026-08-20 has passed as of today (2026-08-21). While the original July 2026 disclosure confirmed SonicWall SMA1000 zero-days were exploited for weeks, no documented critical breach attributed to these specific vulnerabilities has been publicly announced by CISA, researchers, or vendors in the recent intel batch. The resolution criteria explicitly requires documentation of a critical intrusion or data breach attributed to exploitation of these zero-days.

Will Cursor, Codex, Gemini CLI & Antigravity sandbox escapes be fully patched by mid-Aug 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline 2026-08-20 has passed as of today (2026-08-21). No evidence of complete patching or confirmation from all affected vendors (Cursor, Codex, Gemini CLI, Antigravity) that sandbox escapes are fully resolved. The original report from July 2026 indicated patches were 'underway,' but no follow-up confirmation that all vendors have published patches or that security researchers have verified sandbox containment is fully restored by the deadline.

Will WordPress Core 'wp2shell' RCE vulnerability lead to 100+ documented site compromises by Aug 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline was 2026-08-18, which has passed (today is 2026-08-19). No credible evidence from CISA advisories, WordPress security disclosures, Wordfence, Bleeping Computer, or other authoritative sources documents cumulative confirmed compromises or mass exploitation campaigns tied to the wp2shell RCEs reaching or exceeding 100+ documented site compromises. Absence of qualifying event by deadline triggers automatic NO resolution.

Will Siemens Parasolid OOB RCE be added to CISA KEV by end of August 2026?

CISA published alert ICSA-26-225-10 on August 14, 2026, confirming the Siemens Parasolid out-of-bounds read vulnerability affecting X_T file parsing, enabling arbitrary code execution. Siemens released patches. The alert is authoritative CISA documentation of the vulnerability.

Will the fake GitHub infostealer repos compromise 100+ victims by Sept 30?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-08-14; today is 2026-08-15. No public evidence documents 100+ victims compromised via fake GitHub infostealer repos. Recent intel does not include breach disclosures, victim reports, or CISA advisories confirming credential theft or account takeovers at scale.

Will Ghostcommit prompt-injection technique lead to a documented AI agent compromise by end of 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-08-11; today is 2026-08-15. No credible public evidence of documented AI agent compromise via Ghostcommit or functionally identical PNG-embedded prompt-injection attack has emerged. The technique was disclosed as a proof-of-concept but no production compromise has been reported.

Will OpenAI's GPT-5.6 Sol Hugging Face breach vulnerabilities be publicly detailed by Aug 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline was 2026-08-05. Today is 2026-08-11. No public disclosure of specific CVE identifiers, vulnerability classes, or technical PoC code for the Hugging Face vulnerabilities has been found in available security intelligence or recent news. The incident was reported at a high level (Bleeping Computer, OpenAI blog), but no detailed technical disclosures meeting the resolution criteria are present.

Will FastJson RCE zero-day be patched by end of August 2026?

[Auto-closed — deadline passed with no qualifying event] Deadline was 2026-08-04 (today is 2026-08-05). No evidence of a patch or security advisory from Alibaba (FastJson maintainer) or CISA KEV addition confirming a patched version. The deadline has passed with zero credible evidence of patch availability.

Will WordPress 'wp2shell' RCE flaws be actively exploited in the wild within 14 days of PoC release?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-08-02; today is 2026-08-03. The deadline has passed with no credible public evidence from CISA, WordPress.org, Shodan, GreyNoise, Shadowserver, or reputable threat intelligence sources confirming active exploitation of wp2shell RCE flaws within the 14-day window.

Will CVE-2026-16347 (MikroTik RouterOS) be actively exploited by end of 2026?

CISA has published an official ICS advisory (ICSA-26-209-05) confirming CVE-2026-16347 affecting all versions of MikroTik RouterOS and Cloud Hosted Router. The vulnerability allows rapid password guessing and unauthorized system access (CVSS 6.0).

Will the OpenAI autonomous-agent breach impact Hugging Face users by end of 2026?

Hugging Face CEO Clement Delangue publicly confirmed on TechCrunch AI (2026-07-26) that an 'unprecedented' autonomous-agent cyberattack originating from OpenAI affected Hugging Face. This constitutes public disclosure by Hugging Face leadership confirming the breach impacted their platform and users.

Will the threat described as "CISA Adds Two Known Exploited Vulnerabilities to Catalog" result in a significant documented breach within 90 days?

CISA's July 22, 2026 alert confirms two vulnerabilities added to KEV catalog: CVE-2026-16232 (Check Point SmartConsole Improper Authentication) and CVE-2026-50522 (Microsoft SharePoint Deserialization). Both include evidence of active exploitation.

Will CVE-2026-35273 (PeopleSoft zero-day) be added to CISA KEV by end of June 2026?

[Auto-closed — deadline passed with no qualifying event] Market deadline was 2026-07-01. Today is 2026-07-08 (7 days post-deadline). No credible evidence found in recent intel or public sources that CVE-2026-35273 has been added to CISA KEV or that Oracle has released a patch. The deadline has passed without qualifying evidence of resolution.

Will the US Government approve the release of Fable 5 and Mythos 5 to customers again before August?

Will CISA add CVE-2024-3400 (Palo Alto PAN-OS command injection) to the KEV catalog?

CISA added CVE-2024-3400 to the KEV catalog on April 12, 2024 with a federal remediation deadline of April 19, 2024. Active exploitation confirmed by Palo Alto Unit 42 and Volexity before the patch was widely deployed.

Will a ransomware attack cause a major US healthcare payment processor to go offline for more than 7 days in 2024?

BlackCat/ALPHV attacked Change Healthcare on February 21, 2024, taking it offline for over 30 days and disrupting prescription processing for thousands of US pharmacies. UnitedHealth Group reported $872M in losses in Q1 2024.

Will international law enforcement disrupt LockBit ransomware operations by mid-2024?

Operation Cronos confirmed February 19, 2024. NCA, FBI, Europol, and 10 allied agencies seized LockBit's primary leak site, 34 servers, 200 cryptocurrency wallets, and arrested/indicted key affiliates.

Will Ivanti Connect Secure zero-day vulnerabilities be actively exploited before a full patch is available?

Volexity confirmed active exploitation of CVE-2023-46805 and CVE-2024-21887 as of January 10, 2024. CISA issued Emergency Directive 24-01 requiring federal agencies to disconnect affected devices. Over 2,100 devices were compromised globally before patches were available.

SELFTEST contested market — will it resolve YES?

SELFTEST xp market 1 @20%