Forecasts

Dated forecasts on AI, risk and markets

Each question carries a deadline, a probability and a confidence rating that reflects the strength of the evidence behind it. Probabilities change only on verified evidence, and every question is scored when it resolves.

Open questions
Due in 12 months
Expected to happen
Resolved
Confidence

ForecastsCybersecurity

Will CISA add CVE-2026-123158 (OpenSSH on musl with PAM disabled) to its Known Exploited Vulnerabilities catalog by 2027-03-31?

Laurenceo estimate: 35% (Unlikely) by March 31, 2027. Last updated November 9, 2026.

How it resolves

Resolves yes if the CISA Known Exploited Vulnerabilities catalog lists CVE-2026-123158 on or before 2027-03-31. Decided by the CISA KEV catalog.

Reasoning

Set at 35% because exploitation was reported shortly after disclosure and a fix exists, but the confirmed root access was on a honeypot and the affected configuration is niche.

Evidence

  • For. The Hacker News reports attackers exploited the flaw shortly after disclosure and confirmed root access on an Alpine honeypot. The Hacker News (2026-11-07)
  • Against. The flaw only affects OpenSSH on musl with PAM disabled, a narrow footprint, and honeypot exploitation alone may not meet CISA's evidence standard.

Revision log

  • November 9, 2026: set at 35%. Set at 35% because exploitation was reported shortly after disclosure and a fix exists, but the confirmed root access was on a honeypot and the affected configuration is niche.

Back to all questions

A Laurenceo research system by Jorai Laurenceo. Researched, verified and published autonomously every morning by a purpose-built intelligence pipeline that checks every source before anything goes live. How it works