An emergency patch had several public kinds of protection

Study: LH024, version 0.2, 30 October 2026 (version 0.1, 22 October). Status: closed; daily reads 22 to 28 October. Writer: Codex, GPT-6 Sol in ChatGPT Work Mode (version 0.1); daily checkpoints from 23 October and this version's synthesis by Claude Code driving and scheduled runs (Claude Opus 5.5), the synthesis from the retained reads and checkpoints. Protocol: local commit a7fdc47, mirrored in PR #26 before panel search. Observation: 22 October UTC, direct source timestamps in the read log, then one search round and one read a UTC day through 28 October (checkpoints). Overlap: the same two-CVE PHP episode studied by LH018–LH023; the source and Docker records are reused context, not independent events. Model spend: unknown in this harness; no paid external API.

Answer

The fixed public panel exposes different sorts of response: PHP's release notice, public-agency advice, and network providers' claims about traffic rules. Of ten selected institutions, six supplied directly readable relevant pages in this bounded snapshot (PHP, UK NCSC, CERT-EU, Cloudflare, Fastly and Akamai). CISA refused a direct request; AWS and Google Cloud returned Site Unavailable pages with HTTP 200; the Azure site-restricted search supplied no selected relevant page. Those four are instrument outcomes, not evidence of inactivity. Three selected media outlets supplied article metadata, not operator-action evidence. The panel is purposive and supports no percentage about all operators or protected sites.

Over the week, to 28 October. From 23 October eight of the ten institutions had directly readable pages at every read, after AWS's and Google Cloud's pages, placeholders on 22 October, became readable; CISA's alert refused the reader at all seven reads, and Azure never had a selected page. The day's searches added three own-domain records on 23 October (an AWS security bulletin, a Fastly post and a BleepingComputer article) and none after. The claims that changed did so by 23 October: AWS's bulletin, by its own fields updated on 22 and 23 October, described automatic platform updates for Elastic Beanstalk, blueprints for Lightsail that running instances cannot take in place, and then affected EMR releases and Bref for Lambda; Google Cloud's blog took editor's notes to 23 October and claims its Gemini 4 Argon model contributed to finding and patching the flaws. Those changes are dated 23 October or earlier by the sources' own clocks and were all seen by the 24 October read; from 25 to 28 October no exposed title, canonical, published, modified or author field changed, and server headers moved on pages whose visible text did not. Of the institutional pages, only PHP's, CERT-EU's and Cloudflare's named the related flaw CVE-2026-115560, at every read from 23 October.

Findings

The 13-entry event sheet keeps each classification, source clock and limitation. The upstream php.announce message has a 20 October 19:33:47 UTC Date field for the advance notice. NCSC's page has a 21 October 12:00 UTC time element and recommends inventory, updating, temporary mitigation and considering taking unprotected systems offline. CERT-EU gives 21 October 15:20:18 as its release time and advises patching or temporary isolation where immediate patching is infeasible. These are source-reported publication fields seen retrospectively on 22 October, not clocks observed as they happened.

Cloudflare's page, published at 21 October 13:56:45 UTC by its metadata and later modified, says WAF protections became default for its free and paid WAF customers at 03:02 UTC on 21 October. That earlier time is the company's retrospective claim. Fastly's blog and changelog describe a CVE-specific virtual patch available to activate; the blog says later updates reach those who opt in. Akamai's page says App & API Protector security updates and rule 3000991 v1 were released. None of the three pages exposes a denominator of applicable customer sites, a verified rule activation per site, or a controlled measure of efficacy. All still recommend applying the upstream PHP fix.

The Register's two retained article metadata records have 21 October publication fields at 15:08:51 and 23:02:57 UTC; Ars's article says it was originally published on 20 October but its extracted article:published_time is 21 October 02:12:18, a conflict this snapshot cannot resolve. BleepingComputer's selected page supplied no precise timestamp to this reader. These articles mark a bounded sample of coverage; their full text is not republished in the repository.

Method

The brief fixed ten institutions, three outlets, query strings, a daily window and ceilings before this panel search. One bounded site-restricted search per entry was attempted, with three queries repeated after the search tool's output was truncated. The chosen URL manifest contains at most two results per entry; the direct reader attempted 17 URLs. It retained 1,997,296 bytes in total, including error bodies, and logged retrieval times, URLs, status, hashes and extracted metadata. Sixteen requests returned HTTP 200 and one 403, but four of the 200 responses were unavailable placeholders. The offline replay checks panel sizes, source mapping, retained primary byte hashes and access-failure bodies. Media response hashes were recorded but their full bodies were discarded, so those hashes cannot be independently replayed offline.

Protocol deviation: the search connector output was not itself retained with exact query invocation times and full ranked results. The selected URLs, frozen queries and direct reads are retained; nonselected search hits and precise search times cannot be replayed. This weakens any comparison of a missing result or search rank. Future collection must persist its full bounded search response before treating such a comparison as complete.

Limits

• This was observed on 22 October after many pages had already been published or revised. A source's published field cannot by itself establish when a particular sentence was first visible. Cloudflare's claimed 03:02 protection predates its article; this reader did not observe the rules then.
• HTTP 200 alone is not access. The four Site Unavailable bodies leave AWS and Google Cloud's advisory contents unknown in this instrument; a search snippet is discovery, not the retained page.
• A vendor's claim of a deployed rule, an available opt-in rule, advice to take a system offline, and an actual patched deployment are different kinds of record. None counts hosts, attack attempts or avoided compromises here.
• One search per organisation and two pages per entry can miss releases, social posts, customer advisories and revisions. The institutions were chosen by role with several known pages disclosed in the brief, and are not a representative sample. Media publication clocks may change upon revision.

The week, 22 to 28 October

From the retained reads and the daily checkpoints. week.py counts, per read and institution, the selected URLs that answered HTTP 200 with more than 1,000 bytes, and the retained institutional bodies that contain 115560; its output is data/week-2026-10-30.txt. Media bodies are not retained, so media entries are counted for access only. Read start times (UTC): 22 October 06:24, 23 October 17:44, 24 October 06:38, 25 October 06:35, 26 October 06:37, 27 October 06:36, 28 October 06:37.

Access. 22 October: six institutions readable (PHP, UK NCSC, CERT-EU, Cloudflare, Fastly, Akamai); AWS and Google Cloud placeholders; CISA refused; Azure no page. 23 to 28 October: the same six plus AWS (three URLs) and Google Cloud (two URLs, the bulletins page cut at the 512 KiB ceiling) readable at every read; CISA refused at every read; Azure no page. Akamai answered this collector at every read while LH030's collector, with a different user agent, was refused on 23 October, so access depends on the reader as well as the day. An inaccessible page leaves its institution unknown, not inactive.

What the searches added. On 23 October three own-domain results naming the CVEs were added under a rule set that day after the results were seen, which added and dropped nothing else (23 October checkpoint): AWS security bulletin 2026-143-AWS, Fastly's post "Critical RCE Vulnerabilities Discovered in Core PHP", and BleepingComputer's article (media, metadata only). From 24 to 28 October no own-domain result was new, and the selection was unchanged. The search tool did not honour site: for ten of the thirteen queries on 23 October, so "not found in bounded search" mostly measures the tool.

Kinds of protection claimed, by 28 October (each the institution's own claim; none observed on any host):

Every institution that described a traffic rule also recommended the upstream fix. No page gives a denominator of customer sites, a verified activation per site or a measure of efficacy.

Revisions. Claims changed in the exposed fields and visible text only by 23 October: AWS's bulletin (published 21 October 14:30 PDT; updated 22 October 14:00 and 23 October 13:30 PDT, the second adding affected Amazon EMR releases, Bref's release for PHP on Lambda and Amazon Linux packages in all regions); Google Cloud's blog (editor's notes on 21 October, 22 October 09:25 and 16:07 PDT, and 23 October 15:20 PDT, "additional guidance from Mandiant Consulting"); Cloudflare's post (modified 23 October 15:09 UTC by its field; LH028 keeps the content); and The Register's two modified times (23 October 18:18 and 18:21 UTC). The last of these were first seen at the 24 October read. From 25 to 28 October no exposed field changed, and where a Last-Modified header moved (PHP's archive on 26 October, matching the Windows-builds item LH030 recorded; Cloudflare, Fastly and AWS on 26 and 27 October) the visible text was unchanged, so these are server changes, not claim revisions. Google Cloud's bulletin GCP-2026-072 (published 24 October) has been in the retained bulletins page since the 25 October read.

The related flaw. CVE-2026-115560, which PHP announced on 23 October, appears in the retained bodies of PHP's, CERT-EU's and Cloudflare's pages at every read from 23 October and in no other institution's (NCSC, Fastly, Akamai, AWS, Google Cloud; CISA unread). LH030 follows that question on its own frame; nothing here is counted there.

AI's role, as claimed. Google Cloud's blog says Wiz "used a mix of models" and that Gemini 4 Argon contributed to finding the vulnerability, exploit development, attack detection and validation of the patch; OpenAI's account (LH028) credits one of its models used by a Calif researcher, with Wiz finding both flaws independently. Both are claims about defensive work by the companies whose models they name; neither concerns an attacker's tools, and they are not reconciled here.

The interim account. The brief's interim report after 24 October was not written separately; the 23 and 24 October checkpoints hold what it would have said, and this synthesis supersedes it. No public piece is made from this study; one would need the evidence review and the reader-and-inference review first.

Next

None under this brief: its daily reads ended on 28 October. LH030 reads the same institutions' URLs twice a week for the related flaw. The record's earlier aims stand for any later study: a direct source API or durable archive for CISA's refused alert (row LH031-criteria in the schedule), and keeping a timed defensive claim distinct from a demonstrated updated runtime. Google Cloud's AI claim is a candidate for the PHP account's next dated revision (row php-account-rev).

Corrections

Version 0.2, 30 October 2026: closes the study with the synthesis of the week's reads; adds the week to the Answer and replaces Next. The first read's answer is unchanged. Version 0.1 is in git history (git show b4633d0:studies/LH024/LH024.md).

Version 0.1, 22 October 2026: first record. No earlier edition.