Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH031

LH031 reads: 2 November 2026

Catalogue read at 15:27 UTC (label 2026-11-02T1527Z)

Catalogue version 2026.10.30, released 30 October 17:02:45 UTC, 1,766 entries (two added since 2026.10.29, both Ivanti Connect Secure, dateAdded 30 October, neither naming PHP); CISA's feed answered directly (HTTP 200) (extract). CVE-2026-109618 and CVE-2026-109619 are listed with dateAdded 26 October and are unchanged in every field against the 30 October 13:04 read. CVE-2026-115560 is not listed: no new KEV entry among the three CVEs. Entries outside the three whose text mentions PHP or one of the three CVEs (the mentions list) include CVE-2026-46300 (dateAdded 28 October, names CVE-2026-109618 and CVE-2026-109619), already logged; no mention is newly added since the last read.

Vendor read at 15:27 UTC (label 2026-11-02T1527Z, amendment 5, first read)

Advisory, CSAF and Unit 42 each answered HTTP 200 (read log, extract). The baseline for the advisory and Unit 42 is the 30 October php-leads copies (notes/php-leads-2026-10-30/pages/panw-advisory.raw and unit42.raw), run through this read's own extractors without a new fetch.

  • Advisory: Published 2026-10-21, Updated 2026-10-29, Exploit Maturity ATTACKED. Fixed builds: unchanged (20 builds, the same set in the product and solution tables). The "will be fixed in the upcoming releases" sentence: present, as in the baseline. "Until PAN-OS fix versions are available": present. "Active exploitation has been observed": present. "Previously impacted" sentences: unchanged (Cortex XCORE (SaaS) remediated 21 October; WildFire Cloud 22 October).
  • Unit 42: title "Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)", Published October 29, 2026, one update heading (October 29, 2026); actively exploited, independently verified, patched customers not affected and approximately .02 per cent impacted sentences all present, unchanged.
  • CSAF (no earlier read, so no class against a baseline): tracking version "1", initial release 2026-10-21T16:00:00Z, current release 2026-10-31T03:51:53Z, sixteen revision entries, the last numbered 16 dated 2026-10-29T16:54Z ("Removed ETAs for 11.1.7-h12 as the version is released"). Revisions 6 (22 October 20:45 UTC) added ETAs for hotfix releases; revisions 9 to 16 (24 to 29 October) remove those ETAs build by build as released; the build-by-build dates in them are the vendor's own clock. The current_release_date (31 October 03:51 UTC) is later than the last revision entry; the document does not say what changed then, and it is recorded as given. The extractor's remediations list is empty and fixed_product_ids has 20 entries.

Nothing changed in the vendor's fixed builds or exploitation sentences against the baseline. Not flagged for review. The CSAF's current release date after its last revision entry is recorded for the next read to compare. These readings date the vendor's statements; they do not show when a build reached any customer or that any system was compromised.

From studies/LH031/checkpoints/2026-11-02.md in the repository, last changed 2 November 2026.