Michael W 1 day ago
@kyle_ridolfo is here! Who let that riff-raff in?
The Shell Game: PHP2Shell Fallout
In progressA 9.2-rated PHP bug leaked early, governments yanked their websites offline, and an emergency patch dropped Oct 21. Now the fun part: Will the feds flag it as exploited? Does PHP need a second emergency fix? Will it earn its own Wikipedia page? Seven picks, zero coding knowledge required. Picks lock Thu, Oct 22 at noon ET.
1 of 7
Lightning strikes twice? Will PHP publish another Critical-severity security advisory (github.com/php/php-src/security) between Oct 22 and Nov 20, 2026?
Oct 22 @ 4:00 PM
Pick the correct answer.
PointsYesA new advisory rated Critical, published Oct 22 through Nov 20, 2026
+5
No
+1
2 of 7
Which PHP2Shell CVEs will be in CISA's Known Exploited Vulnerabilities catalog at 11:59 PM ET on Nov 20, 2026?
Oct 22 @ 4:00 PM
Pick the correct answer.
PointsNeither
+3
Only CVE-2026-109618
+4
Only CVE-2026-109619
+4
Both
+1
3 of 7
When will CISA add the first PHP2Shell CVE (CVE-2026-109618 or CVE-2026-109619) to its Known Exploited Vulnerabilities catalog?
Oct 22 @ 4:00 PM
Pick the correct answer.
PointsBy Fri, Oct 23Based on the catalog's "date added" field
+2
Oct 24–31
+3
Nov 1–20
+4
Not by Nov 20
+4
4 of 7
Will PHP raise the dead? Will php.net publish a new official PHP 8.1.x release by Nov 20, 2026?
Oct 22 @ 4:00 PM
Pick the correct answer.
PointsYesMust be a new numbered 8.1 release; source-code patches don't count
+10
No
+1
5 of 7
Version roulette: What will be the newest PHP 8.5.x release on php.net at 11:59 PM ET on Nov 30, 2026?
Oct 22 @ 4:00 PM
Pick the correct answer.
Points8.5.12No new 8.5 release after the Oct 21 emergency fix
+8
8.5.13
+1
8.5.14 or higher
+4
6 of 7
How scary does the internet think it is? What will FIRST.org's EPSS score be for CVE-2026-109618 on Nov 1, 2026?
Oct 22 @ 4:00 PM
Pick the correct answer.
PointsNo score published
+7
Under 10%
+4
10% to under 50%
+3
50% to under 90%
+2
90% or higher
+2
7 of 7
Wiki-worthy? On Dec 1, 2026, will English Wikipedia have a standalone article about PHP2Shell? (Any title counts; a section inside a broader article like "PHP" doesn't.)
Oct 22 @ 4:00 PM
Pick the correct answer.
PointsYes
+1
No
+3