Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH036

LH036 reads: 2 November 2026

Monday read at 15:26 UTC (label 2026-11-02T1526Z)

The first scheduled Monday read (row LH036-2026-11-02). The collector started at 15:26:33 UTC and finished at 15:26:37 UTC; all 12 URLs answered HTTP 200 (read log). The kernel CVE team's announcement on git.kernel.org again returned the "Making sure you're not a bot!" challenge page, so it is unavailable at this read, as at the baseline. Figures from tables.json, rewritten by scripts/tabulate.py over both reads; the comparison is with the baseline of 1 November at 08:30 UTC (checkpoint). Written by a Claude Code subagent of the scheduled run of 2 November 2026 (Claude Opus 5.5, as reported by its harness). Model disclosure: the exploit and the post are Anthropic's, and this session runs on an Anthropic model.

In short: no KEV listing, no CISA ADP container, no EPSS step. Red Hat now lists fixed releases for RHEL 8, 9 and 10, and AlmaLinux's post changed to say the fix is in its production repositories. Both are new since the baseline.

EPSS (measure 1; derived from the API's series). Two new dates: 1 November 0.00457 (percentile 0.39666) and 2 November 0.00457 (percentile 0.39649), the same score as 31 October. No new step. The only step in the series remains 25 October (0.00165 to 0.00388), as at the baseline. Dates already held by the baseline keep the baseline's values under the brief.

KEV (measure 2). Not listed. The catalogue served was the same version as at the baseline, 2026.10.30 (released 2026-10-30T17:02Z; Last-Modified Fri, 30 Oct 2026 17:02:45 GMT), so this read adds no newer catalogue to check against.

The record (measure 3).

  • CVE record: unchanged since the baseline (dateUpdated 2026-10-31T21:04:43Z). CNA CVSS 3.1 vector unchanged. One ADP container, the CVE Program's; no CISA ADP container, and so no SSVC values.
  • NVD: unchanged, vulnStatus Received, lastModified 2026-10-31T21:16Z, the CNA's metric only (Secondary), no NVD score.
  • OSV: modified 2026-11-02T12:26:58Z (at the baseline, 2026-11-01T02:30Z).
    • Related list grew from 8 to 20 advisories. New: ALSA-2026:93414 and ALSA-2026:93415 (AlmaLinux), and SUSE-SU-2026:24437-1, 24446-1, 4960-1, 4969-1, 4972-1, 4977-1, 4978-1, 4979-1, 4983-1 and 4984-1. None was opened; they are listed as OSV gives them.
    • References: one new, the oss-security post of 31 October (openwall.com/lists/oss-security/2026/10/31/5), already in the CVE record at the baseline. OSV now holds 14 references.

Fixes (measure 4; observation, as each tracker gives it).

  • Red Hat: newly fixed. The tracker now lists fixed releases, each dated 2026-11-01T00:00:00Z by Red Hat:

    • RHEL 10, kernel-0:6.12.0-211.72.1.el10_2, RHSA-2026:93413;
    • RHEL 9, kernel-0:5.14.0-687.64.1.el9_8, RHSA-2026:93412 (listed twice, under two CPEs);
    • RHEL 8, kernel-0:4.18.0-553.182.1.el8_10, RHSA-2026:93414;
    • RHEL 8, kernel-rt-0:4.18.0-553.182.1.rt7.523.el8_10, RHSA-2026:93415;
    • "Shadow Migration Toolkit for Virtualization for RHEL 10", the same RHEL 10 kernel under RHSA-2026:93413 (the product name as Red Hat gives it).

    Observation interval: after the baseline read (2026-11-01T08:30Z), at which no fixed release was listed, and at or before this read (2026-11-02T15:26Z). Red Hat's own date, 1 November, is a day with a midnight time and is recorded beside the interval, not substituted for it. Still Affected: RHEL 9 kernel-rt, RHEL for NVIDIA 26, and OpenShift 4's and 5's CoreOS images. RHEL 6 and 7 are not affected, as before. Red Hat's CVSS 9.8 changed from "draft" to "verified"; threat severity Critical, unchanged.

  • Debian: no suite changed status. sid's fixed version moved from 7.2.14-1 to 7.2.15-1 (still fixed). The bookworm (6.1.176-1) and trixie (6.12.107-1) point releases remain listed vulnerable.

  • Ubuntu: unchanged. Priority high; pending in stonking, jammy, noble and resolute; needed in bionic, focal and xenial; not affected in trusty; no Ubuntu notice listed.

  • SUSE: overall state Pending, as before (Last-Modified Mon, 02 Nov 2026 14:01:50 GMT). Counted as at the baseline, by products with at least one main kernel package (kernel-default, kernel-source, kernel-rt or kernel-64kb), nothing changed: 112 products; 18 only Released, 1 Released and Affected, 81 only Affected, 6 only In progress, 2 Affected and In progress, 4 Not affected. The changes are in the live patches, which that count leaves out:

    • 55 live-patch package rows went from In progress to Released: 9 for Live Patching 12 SP5, 10 for 15 SP4, 12 for 15 SP5, 13 for 15 SP6 and 11 for 15 SP7;
    • the 32 live-patch rows listed under each of SUSE Linux Micro 6.0 and 6.1 at the baseline are no longer listed under those products (the products remain on the page);
    • 13 new live-patch rows (kernel-livepatch-SLE16-RT) appear under SUSE Linux Micro 6.2, all In progress.

    The page has 424 product and package rows, against 475 at the baseline. Whether a Released live patch covers a given running kernel is not read here.

The pages (measure 5).

  • Anthropic's post: unchanged. Same body bytes and text as at the baseline; dateModified 2026-10-30T15:24:16Z.
  • AlmaLinux's post: changed (text_sha256 9cf106a5..., against 33e4b40a... at the baseline). The title went from "Patched kernels available in testing" to "Patched kernels released". The post now has an update notice and a changelog entry dated 2026-11-02, saying the fix is included in the regular kernel updates in the production repositories for AlmaLinux 8, 9 and 10, since kernel-4.18.0-553.182.1.el8_10, kernel-5.14.0-687.64.1.el9_8 and kernel-6.12.0-211.72.1.el10_2. The testing kernels of 30 October (553.180.2, 687.61.2, 211.69.2) are said to contain the fix as well and to be replaced by these. The testing instructions are kept as historical. A banner line elsewhere on the page also changed (an event notice), which is not about this CVE. These production versions are the same as Red Hat's fixed releases above, and OSV's two new ALSA ids share the numbers of Red Hat's RHSA-2026:93414 and 93415. That is a match of strings as given, not a check of builds. AlmaLinux is not one of the brief's measure-4 trackers, so this is a page change, not a fix observation under the brief.
  • Kernel announcement: unavailable (challenge), as at the baseline.

Not checked: the new OSV advisories' own pages, Red Hat's RHSA pages and AlmaLinux's errata; whether any fixed package was installed or a machine rebooted into it.

Rows: LH036-2026-11-02 done.

From studies/LH036/checkpoints/2026-11-02.md in the repository, last changed 2 November 2026.