Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH036

LH036 reads: 9 November 2026

In short. Monday's read of how the Linux flaw behind one of Anthropic's attack chains, CVE-2026-98432, is scored and fixed. CISA's catalogue still does not list it, its EPSS score held at 0.76 per cent through 8 November, and NVD moved it to "Awaiting Analysis" with no score of its own and no CISA container. Ubuntu now has a fix released for one release and fixes pending for every other affected one, including the three oldest, which had none on 5 November.

Monday read at 14:30 UTC (label 2026-11-09T1430Z)

The scheduled Monday read (row LH036-2026-11-09), the first under the robots.txt gate of the 8 November amendment. The collector started at 14:30 UTC; 11 URLs answered HTTP 200 (read log). The kernel CVE team's announcement on git.kernel.org was not fetched: git.kernel.org's robots.txt disallows it, so it is a missing reading at this read, as the amendment says (at the three reads before it returned a challenge page). Figures from tables.json, rewritten by scripts/tabulate.py over all four reads; the comparison is with the read of 5 November at 14:14 UTC (checkpoint), so every change below happened after 2026-11-05T14:14Z and by this read, unless a source dates it.

  • KEV: not listed in catalogue 2026.11.06 (released 6 November 19:44:45 UTC).
  • CVE record: unchanged (dateUpdated 3 November 06:08 UTC); the CNA's CVSS 3.1 vector is the same 9.8 vector; the only ADP container is the CVE Program's. No CISA ADP container.
  • NVD: status "Received" changed to "Awaiting Analysis", lastModified 6 November 19:28:12 (NVD's clock). The only metric is still the CNA's, as Secondary; NVD has added no score of its own.
  • EPSS: 0.0076 (0.76 per cent) on each of 5, 6, 7 and 8 November, the value it stepped to on 3 November; percentile 0.554 to 0.555. No EPSS step since the last read.
  • OSV: modified 8 November 02:31 UTC; the related list now names SUSE-SU-2026:5107-1 and 5121-1 beside 5091-1 and openSUSE-SU-2026:22167-1.
  • Debian: fixed versions moved on in every release (trixie 6.12.116-1, forky 7.2.15-1, sid 7.3.3-1, bookworm's linux-6.12 6.12.115-2~deb12u1); all fixed, as before.
  • Ubuntu: priority critical, as on 5 November. stonking: pending → released (7.3.0-10.10). bionic, focal and xenial: needed → pending, with versions 4.15.0-263.275, 5.4.0-247.267 and 4.4.0-293.327. jammy, noble and resolute still pending; no Ubuntu security notice is listed. A pending state is Ubuntu's word for a fix built but not yet released; the oldest three releases are covered only under Ubuntu's paid extended support, which this read cannot see.
  • Red Hat: Critical, 9.8, verified, as before. New fixed releases for OpenShift Container Platform 4.20, 4.21 and 4.22 (RHSA-2026:95377, 95408 and 95346, dated 9, 9 and 6 November by Red Hat); the package-state list adds "Red Hat Enterprise Linux 7, kernel-rt: Not affected".
  • SUSE: overall "Pending", as before; the first states listed are the same released openSUSE Leap 15.6 kernels.
  • Anthropic's post: the bytes changed and dateModified did not (30 October 15:24:16 UTC); the text differs only in the site footer (the company's mission line) and a navigation label. The post's own text is unchanged.
  • AlmaLinux: the page's bytes changed; its classes are as before (no reading of fixed versions is part of the brief's measures).

Nothing here is a KEV listing, a CISA ADP container, an EPSS step or a newly fixed release in the brief's sense except Ubuntu's stonking release and Red Hat's OpenShift fixes, which the commit message names. Not flagged for review: no public account cites these states beyond the investigation page's dated line of 1 November.

From studies/LH036/checkpoints/2026-11-09.md in the repository, last changed 9 November 2026.