LH037 checkpoint: baseline, 1 November 2026, 14:20 UTC
Protocol 0.1. Read data/read-2026-11-01T1420Z/ (23 route GETs, 14:20 UTC; read_log.json), then the five statements the routes named, fetched by hand under the same rules at about 14:30 UTC (found_log.json), now in panel.json's advisories. Palo Alto Networks' advisory is taken from the 30 October read retained in notes/php-leads-2026-10-30/pages/panw-advisory.raw, as the brief's overlap says; LH031 reads it from 2 November. Every statement below is the vendor's own, as read; nothing was checked against a product. Writer: the scheduled run 2026-11-01T1415Z (Claude Code, Claude Opus 5.5); unreviewed.
Rule panel (20 vendors)
| Vendor | Route | Class | Vendor's statement and clocks | PHP branch stated |
|---|---|---|---|---|
| Microsoft | update guide API, both CVEs: HTTP 200, 134 bytes | unavailable (by the brief's 200-byte rule) | The body is a well-formed empty answer, "@odata.count":0: Microsoft's guide lists no product for either CVE. The brief counts a body under 200 bytes as unavailable, a rule meant for failures; the record will give both readings. |
— |
| Apple | security releases list: read | no statement found | Newest entries dated 23 to 30 October; no mention of the CVEs or of PHP. | — |
| Cisco ⚑ | PSIRT feed: read | affected, fixed for some | cisco-sa-php-october26-Jj384Daq, Critical, first published 2026-10-21 19:12 GMT, last updated 2026-10-30 19:24 GMT, version 1.10 Final (1.0 to 1.7 Interim; 1.8 Final on 27 October). Vulnerable: Ultra-Reliable Wireless Backhaul and Unified Industrial Wireless Software (CSCwx37073, fixed release 26.2.1.9 "(Nov 2026)", an estimate; administrator authentication required, CVSS 6.6; workaround); Expressway and Expressway Select (CSCwx37062, 15.5.21; workaround); Duo Access Gateway (3.2.0); ISE Portal Builder ("Fix deployed, no customer action required"). Several dozen products and services confirmed not vulnerable; "If a product is not listed within this advisory, Cisco's review indicates that the product is not affected". Exploitation: "The Cisco PSIRT is not aware of any malicious use of these vulnerabilities against any Cisco product." |
not stated |
| Cloud bulletins feed: HTTP 404 | unavailable | Route may be replaced once (brief, Routes). | — | |
| Ivanti | advisory blog topic: read, no items in the served page (script-rendered) | unavailable | Route may be replaced once. | — |
| Fortinet ⚑ | PSIRT feed: read | investigating | FG-IR-26-186, Critical, published 21 October 2026 (feed and CSAF give no time), page updated 28 October (CSAF current_release_date 2026-10-27, revision history one entry; the two disagree by a day). Under investigation: FortiDDoS, FortiSOAR, FortiSOAR PaaS. About 50 products "confirmed NOT Impacted", among them FortiOS, FortiManager, FortiAnalyzer and FortiWeb. Four FortiClient forensics cloud services remediated, "customers need not perform any action". "Known Exploited: No". The page's "Impact: Denial of service" field sits beside a text describing remote code execution. |
not stated |
| Adobe | bulletins page: HTTP 403 | unavailable | Route may be replaced once. | — |
| Linux | no route | no route | — | — |
| Oracle | Oracle Linux CVE pages for both CVEs, and the security-alerts feed: read | affected, fixed for all listed | Oracle Linux's pages (release date 2026-10-21, impact Important, preliminary CVSS 8.1 AC:H) list errata for Oracle Linux 8, 9 and 10 dated 21 and 22 October: ELSA-2026-87070 (OL10 php), ELSA-2026-87071 (OL10 php8.4), ELSA-2026-87073 and -87080 (OL8), ELSA-2026-87072, -87079 and -87151 (OL9), with PECL and PEAR packages. Neither page lists Oracle Linux 7. The security-alerts feed (newest item 24 October) does not name the CVEs: nothing is said about other Oracle products. |
not stated, beyond the package name php8.4 for Oracle Linux 10 |
| Apache | no route | no route | — | — |
| Citrix | bulletins feed: read, body "Loading..." | unavailable | Route may be replaced once. | — |
| D-Link | announcements: read | no statement found | Newest entries 7 and 15 October. | — |
| Palo Alto Networks ⚑ | feed: read; its own URL for CVE-2026-109619: HTTP 404 (one advisory, under CVE-2026-109618, covers both) | affected, fixed for some | Feed item "Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products", pubDate 2026-10-29T23:54Z. The advisory as read on 30 October: published 2026-10-21, updated 2026-10-29, fixed hotfix builds listed, with revision entries of 25 to 27 October removing expected dates "as these versions are released", beside "This issue will be fixed in the upcoming releases of PAN-OS" (R-0044, M1); LH031 amendment 5 follows it. | not stated by the vendor; PHP 8.0.30 by Dream Research's account (R-0044) |
| Synacor | Zimbra Security Center: read | no statement found | No mention of the CVEs. The page records PHP bundled in Zimbra Collaboration Suite in earlier releases ("Upgraded PHP to 8.3.0", ZCS 10.0.8 and 9.0.0 Patch 40, April 2024), so the vendor ships PHP. | — |
| Android | bulletins index: read | no statement found | The index lists bulletins by month, not their contents; weak route. | — |
| Samsung | mobile security updates: read | no statement found | Newest items early October. | — |
| Zyxel | advisories list: read | not affected | "Zyxel statement for PHP core RCE vulnerabilities", initial release 2026-10-28: "no Zyxel products currently available on the market are affected, as they do not incorporate the vulnerable PHP package." | — |
| SonicWall | vulnerability list: script-only page, 729 bytes | unavailable | Route may be replaced once. | — |
| Roundcube | news: read | no statement found | Newest item 19 October (Roundcube 1.6.20 and 1.7.5, before the PHP releases). | — |
| VMware | Broadcom advisory portal: read, list not in the served page (script-rendered) | unavailable | Route may be replaced once. | — |
⚑ partly known before the brief (brief, "What is already known"): Cisco, Fortinet and Palo Alto Networks are also in the named stratum.
At the baseline: 5 of the 20 vendors had a statement naming the CVEs that their routes reached (Cisco, Fortinet, Oracle, Palo Alto Networks, Zyxel); 6 had none found (Apple, D-Link, Synacor, Android, Samsung, Roundcube); 7 were unavailable (Microsoft by the size rule, Google, Ivanti, Adobe, Citrix, SonicWall, VMware); 2 have no route (Linux, Apache). Of the five statements, two say products are affected with fixes for some (Cisco, Palo Alto Networks), one lists fixes for every platform it names (Oracle Linux), one is still investigating three products (Fortinet) and one says nothing it sells is affected (Zyxel). By the vendors' own dates, Cisco, Fortinet, Oracle and Palo Alto Networks first published on 21 October, the day of PHP's releases, and Zyxel on 28 October. No vendor states which PHP version or branch a product carries. Not one says a product of its own was exploited except Palo Alto Networks, whose claim is recorded in the PHP account; Cisco and Fortinet say they know of none.
Named stratum
| Vendor | Route | Class | Statement and clocks | PHP branch stated |
|---|---|---|---|---|
| Splunk | advisories list: read | affected, fixed for all listed | SVD-2026-1013, published 2026-10-22, last updated 2026-10-26. Smartlook "Remedied": "Splunk remedied the CVEs by upgrading PHP to a fixed version. There is no action for Smartlook customers and Splunk has not found evidence of exploitation." Every other listed product, from Splunk Enterprise to Cisco XDR, "Unaffected"; the AppDynamics PHP Agent and the Zabbix integration "do not include or install PHP". Linked from Cisco's advisory. |
not stated ("a fixed version") |
Against what was known
The search-tool summaries of 27 to 30 October had Cisco saying "no products are known to be affected" with over 30 under review. Cisco's advisory as read today lists four affected products or services, three with a fixed release or deployed fix and one with a fix estimated for November; its revision history adds vulnerable products in versions 1.1, 1.3 and 1.8 (21, 22 and 27 October), so the summarised wording was an earlier version's or a press rendering. SOCRadar's "Fortinet investigating" still holds, for three products; "Splunk investigating" does not: Splunk's advisory, a day after SOCRadar's page, lists one remedied product and the rest unaffected.
Nothing flagged
Nothing here changes the PHP account: it makes no claim about these vendors beyond Palo Alto Networks, whose statements LH031 follows. Next read: 2 November (row LH037-2026-11-02). Before it, the six unavailable routes may each be replaced once under the brief.
From studies/LH037/checkpoints/2026-11-01T1420Z.md in the repository, last changed 1 November 2026.