Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH037

Which of the most-exploited vendors say their products carry the PHP flaws of 21 October 2026, on which PHP branch, and when do their fixes appear?

In short. Many vendors ship their own copy of PHP inside products such as firewalls and appliances, and fix it on their own clocks. Twice a week we read what the 20 vendors with most entries in CISA's list of exploited flaws say about the October PHP flaws. At the 5 November read (unreviewed checkpoint), 6 of the 20 had a statement naming the flaws, 7 had none we could find, 5 could not be read and 2 have no channel to read; Google, on 2 November, was the first to say which PHP branches some of its products carry.

Latest read, 9 November 2026, 14:29 UTC (unreviewed working note): Cisco now says a fix is available for every product it lists as affected by the October PHP flaws: its wireless backhaul software, which had a fix promised for November, was marked available on 6 November. No other vendor's statement changed in what we could read, and 6 of the 20 vendors still have a statement our reads reach. Two pages could not be read this time: Oracle's security-alerts feed and alert answered with an error page, and Fortinet's advisory page was not requested because its site's robots.txt could not be reached, so for both we don't know whether anything changed there. No vendor says its own products were exploited, and none newly names a PHP branch. Read the note

No write-up yet studies/LH037/brief.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH037/ in the repository, last changed 9 November 2026.