Will CISA issue an Emergency Directive covering the PHP flaws?

If CISA announces the issuance of an Emergency Directive requiring Federal Civilian Executive Branch agencies to act on the PHP vulnerabilities CVE-2026-109618 or CVE-2026-109619 before Dec 1, 2026, then the market resolves to Yes. An Emergency Directive counts once CISA has published it on its Cybersecurity Directives page. It need not name CVE-2026-109618 or CVE-2026-109619, but its required actions must cover those vulnerabilities in PHP, such as requiring agencies to patch, mitigate, inventory or remove affected PHP systems. A new version of an existing Emergency Directive counts only if that version itself adds required actions covering these vulnerabilities. The following do NOT resolve this market to YES: A Binding Operational Directive. A supplemental direction to an existing Emergency Directive. An addition to the Known Exploited Vulnerabilities catalog, and any remediation deadline that follows from one. A CISA alert, advisory or other guidance urging agencies or the public to patch. A statement that an Emergency Directive is under consideration or forthcoming.