{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:20:23.485Z","page":"https://securitythreatpulse.com/track-record","method":{"unit":"CVE. A call is the first time the rules put the CVE at Act now (or Watch or higher). Before its listing a CVE is named only by its own early event (early-<cve>), so a cluster formed at listing never lends its earlier call to a CVE that joined later. Admin overrides are not scored.","truth":"Listing in CISA KEV or VulnCheck KEV, the earliest of the two.","actNowHorizonDays":30,"watchHorizonDays":90,"scored":"Only calls made before the listing day. right: listed within the horizon. wrong: the horizon passed with no listing. pending: not settled yet.","interval":"95% Wilson interval on right / (right + wrong)."},"rulesVersion":"v3","live":{"since":"2026-10-24","asOf":"2026-11-11T08:20:23.403Z","actNow":{"overall":{"calls":2,"right":2,"wrong":0,"pending":0,"rate":1,"ci":[0.34237195288961925,1],"medianLeadDays":2},"byVersion":{"v2":{"calls":2,"right":2,"wrong":0,"pending":0,"rate":1,"ci":[0.34237195288961925,1],"medianLeadDays":2}},"postConfirmation":100,"calls":[{"cveId":"CVE-2026-109618","eventId":"early-cve-2026-109618","rulesVersion":"v2","calledOn":"2026-10-24","kevDate":"2026-10-26","outcome":"right","leadDays":2,"settlesOn":null,"title":"PHP: 2 flaws used in attacks; attackers can run their own code","url":"https://securitythreatpulse.com/events/early-cve-2026-109618"},{"cveId":"CVE-2026-109619","eventId":"early-cve-2026-109619","rulesVersion":"v2","calledOn":"2026-10-24","kevDate":"2026-10-26","outcome":"right","leadDays":2,"settlesOn":null,"title":"PHP: 2 flaws used in attacks; attackers can run their own code","url":"https://securitythreatpulse.com/events/early-cve-2026-109618"}]},"watch":{"overall":{"calls":39,"right":2,"wrong":0,"pending":37,"rate":1,"ci":[0.34237195288961925,1],"medianLeadDays":2},"byVersion":{"v2":{"calls":37,"right":2,"wrong":0,"pending":35,"rate":1,"ci":[0.34237195288961925,1],"medianLeadDays":2},"v3":{"calls":2,"right":0,"wrong":0,"pending":2}}},"kevCoverage":{"listings":23,"calledBefore":2,"share":0.08695652173913043,"ci":[0.02417949540723341,0.2679640429809402],"medianLeadDays":2}},"versions":[{"version":"v3","released":"2026-11-08","active":true,"verdictsFrom":"v2","summary":"Verdicts are unchanged from v2. Inside Act now, an Act today tier marks flaws with exploitation confirmed in the last 14 days on an internet-facing product, with ransomware use or with public attack tools, and every event gets a 0 to 11 ranking score with one line per factor.","backtest":{"reportVersion":"v2","window":{"from":"2025-04-01","to":"2026-10-01"},"heldOut":{"from":"2026-04-01","to":"2026-10-01"},"actNowAll":{"rate":0.4336283185840708,"ci":[0.3459239380751302,0.5256971283943465],"hits":49,"n":113},"actNowHeldOut":{"rate":0.3548387096774194,"ci":[0.21116447741565816,0.530523619571851],"hits":11,"n":31},"kevCalledBefore":{"rate":0.15035799522673032,"ci":[0.11931864525533667,0.18775047944762538],"hits":63,"n":419},"medianLeadDays":4}},{"version":"v2","released":"2026-10-24","active":false,"verdictsFrom":null,"summary":"An early Act now needs two separate exploitation reports, or one report plus attack attempts seen by honeypots.","backtest":{"reportVersion":"v2","window":{"from":"2025-04-01","to":"2026-10-01"},"heldOut":{"from":"2026-04-01","to":"2026-10-01"},"actNowAll":{"rate":0.4336283185840708,"ci":[0.3459239380751302,0.5256971283943465],"hits":49,"n":113},"actNowHeldOut":{"rate":0.3548387096774194,"ci":[0.21116447741565816,0.530523619571851],"hits":11,"n":31},"kevCalledBefore":{"rate":0.15035799522673032,"ci":[0.11931864525533667,0.18775047944762538],"hits":63,"n":419},"medianLeadDays":4}},{"version":"v1","released":"2026-10-24","active":false,"verdictsFrom":null,"summary":"Designed from the first backtest. Reported exploitation of a CVE 90 days old or newer is Act now, and confirmed exploitation gets two more reasons to be urgent.","backtest":{"reportVersion":"v1","window":{"from":"2025-04-01","to":"2026-10-01"},"heldOut":{"from":"2026-04-01","to":"2026-10-01"},"actNowAll":{"rate":0.17846153846153845,"ci":[0.1406621333089575,0.2237735098700076],"hits":58,"n":325},"actNowHeldOut":{"rate":0.21505376344086022,"ci":[0.14374913397362912,0.30896540192829725],"hits":20,"n":93},"kevCalledBefore":{"rate":0.18854415274463007,"ci":[0.1539839640375088,0.22876361803577822],"hits":79,"n":419},"medianLeadDays":5}},{"version":"v0","released":"2026-10-24","active":false,"verdictsFrom":null,"summary":"The first rules, written before any testing. Confirmed exploitation plus an urgency factor is Act now, and so is reported exploitation with ready-made attack tools.","backtest":{"reportVersion":"v0","window":{"from":"2025-04-01","to":"2026-10-01"},"heldOut":{"from":"2026-04-01","to":"2026-10-01"},"actNowAll":{"rate":0.15841584158415842,"ci":[0.0999267161245613,0.24193758201663454],"hits":16,"n":101},"actNowHeldOut":{"rate":0.07407407407407407,"ci":[0.029181055323684174,0.17554357193420633],"hits":4,"n":54},"kevCalledBefore":{"rate":0.10501193317422435,"ci":[0.07915994737023467,0.13804100920546647],"hits":44,"n":419},"medianLeadDays":58.5}}]}