Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH037

LH037 checkpoint: first Monday read, 2 November 2026, 15:30 UTC

Protocol 0.1 with amendment 1 (2 November, made after the baseline outcomes were seen; Google's, Ivanti's and Citrix's routes replaced). Read data/read-2026-11-02T1530Z/: 28 GETs, 23 routes and the 5 statements recorded at the baseline, 15:30:46 to 15:31:05 UTC (read_log.json). Then the three statements the routes named for the first time were fetched once by collect.py --found, 15:32:02 to 15:32:06 UTC (found_log.json), and added to panel.json's advisories. Compared with the baseline of 1 November, 14:20 UTC. Every statement below is the vendor's own, as read; nothing was checked against a product. Writer: a Claude Code subagent of the scheduled run 2026-11-02T1524Z (Claude Opus 5.5); unreviewed.

Rule panel (20 vendors)

Vendor Route at this read Class Change since the baseline PHP branch stated
Microsoft update guide API, both CVEs: HTTP 200, 134 bytes, identical to the baseline unavailable (by the brief's 200-byte rule) none. Second reading, as the amendment requires: the body is a well-formed empty answer ("@odata.count":0), so Microsoft's guide lists no product for either CVE —
Apple security releases list: read, identical bytes no statement found none —
Cisco ⚑ PSIRT feed and cisco-sa-php-october26-Jj384Daq: read, both identical bytes affected, fixed for some none (still version 1.10 Final, last updated 2026-10-30 19:24 GMT) not stated
Google replaced route (amendment 1): Google Cloud security bulletins feed, read affected, fixed for some unavailable → affected, fixed for some, at the first successful read; statements dated 21 and 24 October (below) stated for Apigee developer portals and Google's serverless runtimes (below)
Ivanti replaced route (amendment 1): Security Advisory blog feed, read, 19 items, newest "October 2026 Security Update" (13 October) no statement found unavailable → no statement found, at the first successful read —
Fortinet ⚑ PSIRT feed, FG-IR-26-186 and its CSAF: read investigating none. The advisory's text and the CSAF are unchanged; the feed changed only in its build time and in another item's revision date not stated
Adobe bulletins page: HTTP 403, "Access Denied" (refusal) unavailable none (not replaced; amendment 1) —
Linux no route no route — —
Oracle Oracle Linux CVE pages and security-alerts feed: read affected, fixed for all listed new statement: the security-alerts feed now carries "Oracle Security Alert Advisory for CVE-2026-109618 and CVE-2026-109619" (below). Oracle Linux pages' text unchanged not stated
Apache no route no route — —
Citrix replaced route (amendment 1): support.citrix.com/securitybulletins/, HTTP 200, 8,422 bytes, body "Loading..." (script-rendered) unavailable none. The replacement also failed; Citrix's one replacement is used —
D-Link announcements: read, identical bytes no statement found none —
Palo Alto Networks ⚑ feed: read; its URL for CVE-2026-109619: HTTP 404, as before affected, fixed for some none from LH037's routes. The PHP item is unchanged (pubDate 2026-10-29T23:54Z); the feed's other items were reordered. The advisory itself is LH031's (amendment 5) not stated by the vendor; PHP 8.0.30 by Dream Research's account (R-0044)
Synacor Zimbra Security Center: read, text unchanged no statement found none —
Android bulletins index: read, no mention no statement found none (weak route, as at the baseline) —
Samsung mobile security updates: read, no mention; newest listed SMR October 2026 no statement found none —
Zyxel advisories list and statement of 28 October: read, text unchanged not affected none —
SonicWall vulnerability list: HTTP 410, 208 bytes, "The request is blocked by WAF!" (refusal; the block notice names site.rate-limit-30k-blocking) unavailable none in class. The way it fails changed: a script-only page at the baseline, a refusal now. Not replaced (amendment 1) —
Roundcube news: read, identical bytes no statement found none —
VMware Broadcom advisory portal: read, text unchanged (script-rendered list) unavailable none (not replaced; amendment 1) —

⚑ partly known before the brief (brief, "What is already known"): Cisco, Fortinet and Palo Alto Networks are also in the named stratum.

At this read: 6 of the 20 vendors had a statement naming the CVEs that their routes reached (Cisco, Fortinet, Google, Oracle, Palo Alto Networks, Zyxel). 7 had none found (Apple, Ivanti, D-Link, Synacor, Android, Samsung, Roundcube). 5 were unavailable (Microsoft by the size rule, Adobe and SonicWall by refusal, Citrix and VMware by script-rendered pages). 2 have no route (Linux, Apache). At the baseline the counts were 5, 6, 7 and 2. Both changes come from the routes replaced by amendment 1 after the baseline was seen: Google moved to a statement, Ivanti to none found. Neither vendor's own statements changed between the reads, as far as these reads show.

New statements, measure 3

Google (rule panel; first successful read, through the replaced route)

The feed (Last-Modified 28 October 2026 15:35 GMT) carries two bulletins naming the CVEs. Each bulletin's full text is in the feed, which is the route. The two pages they link were added to panel.json and fetched once: Apigee's security bulletins page and Google Cloud's blog post.

  • GCP-2026-070, published 2026-10-21, severity Critical. Quoted: "While Google Cloud itself is not vulnerable, users of this language running on Google Cloud may be vulnerable." It also says: "All PHP versions between 5.4 and 8.5" affected; fixes in "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35"; some workloads on App Engine Standard, Cloud Run and Cloud Run functions "may be automatically patched". It links the blog post below.
  • Blog post, "Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619", by Chris Betz (CISO, Google Cloud) and Raluca Ada Popa (Google DeepMind). Published 2026-10-21T21:14:39Z (page metadata). An editor's note says it was updated on 21 and 22 October and on "Oct. 23, 2026 at 3:20 p.m. PDT".
    • It repeats "Google Cloud itself is not vulnerable".
    • Serverless runtimes and branches: App Engine standard environment "(PHP 8.2 and newer): Applications are updated automatically. No action is required." Cloud Run and Cloud Run functions (PHP 8.2 and newer) are updated where automatic base image updates are enabled. App Engine flexible is not updated automatically.
    • "Unsupported runtimes will not be patched ... Applications on PHP 5.5, PHP 7.2, PHP 7.3, PHP 7.4, or PHP 8.1 remain vulnerable and must be upgraded to PHP 8.2 or newer."
    • It says "Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch", alongside Wiz Research.
    • Its only sentence near a statement of exploitation (quoted): "Mandiant Threat Defense is actively supporting customers by monitoring curated detections in Google Security Operations and hunting for evidence of intrusion activity related to this campaign." It names no campaign, no victim and no Google product, and says nothing was found.
  • GCP-2026-072 (Apigee), published 2026-10-24. Apigee's bulletins page says "Last updated 2026-10-26 UTC" and gives no update date for this bulletin. Severity Critical.
    • Not affected: "Apigee, Apigee Hybrid, Apigee Edge for Public Cloud, API hub, and the Apigee integrated portal don't use PHP and aren't affected." Apigee Edge for Private Cloud is not affected "apart from its optional Drupal developer portal". "The impact is limited to Drupal-based Apigee developer portals, which customers deploy and operate."
    • Affected: Apigee Developer Portal Kickstart from Google Cloud Marketplace; the Kickstart Docker image (ghcr.io/apigee/docker-apigee-drupal-kickstart); self-hosted Drupal 10 and 11 portals built with Kickstart or the Apigee Edge module; Apigee Edge for Private Cloud Drupal 7 and Drupal 9 portals (all versions); and self-hosted Apigee Edge for Public Cloud Drupal 7 portals.
    • Fixes:
      • Marketplace: "New deployments from Google Cloud Marketplace use a patched image with PHP 8.3.36". Images apigee-devportal-drupal-202610231240 and later are patched; existing deployments must be patched by the customer.
      • Docker: the :latest, :main and :nightly tags "have been republished with PHP 8.3.36".
      • Self-hosted Drupal 10 and 11: update PHP to a fixed release.
      • Private Cloud Drupal 7 and 9 portals: "These portals run PHP 7.3 or 7.4 on RHEL/CentOS 7, RHEL 8, or Amazon Linux 2, where no packaged fix is available." The advice is to take the portal offline or restrict it, apply the interim mitigations, and migrate. The bulletin adds that upcoming apigee-setup releases for 4.53.01 and 4.54.00 will block installing the portal profile.
    • Workarounds: interim PHP settings (session.upload_progress.enabled=0, memory_limit=-1, a small post_max_size, and on PHP 8.5 fatal_error_backtraces=0), and blocking multipart/form-data where uploads are not needed.
    • Exploitation: no statement that any portal was exploited. It has a "Check for compromise" section, which is conditional: "Updating PHP doesn't remove an attacker who exploited the portal before it was patched."

Google's class: affected, fixed for some, from its most recent statement (GCP-2026-072). Patched images are named for the Kickstart Marketplace and Docker products, and no fix is available for the Private Cloud Drupal 7 and 9 portals. The products named are ones customers deploy and operate. Google's earlier bulletin and the blog say Google Cloud itself is not vulnerable.

PHP branch (measure 4), newly stated:

  • Apigee Developer Portal Kickstart (Marketplace image and Docker image): PHP 8.3, at 8.3.36 after the fix. PHP's 21 October releases fix this branch.
  • Apigee Edge for Private Cloud Drupal 7 and Drupal 9 portals: "PHP 7.3 or 7.4". PHP's 21 October releases fix neither branch, and the bulletin says no packaged fix is available.
  • Google's serverless runtimes: PHP 8.2 and newer patched automatically where enabled. PHP 5.5, 7.2, 7.3, 7.4 and 8.1 runtimes "will not be patched".

Clocks. Vendor's clock: first published 21 October (GCP-2026-070 and the blog, 0 days after PHP's releases); Apigee's bulletin 24 October (3 days). First fixed release named: the patched Marketplace image apigee-devportal-drupal-202610231240, whose name carries 23 October 12:40 (2 days). That date comes from the image's name, not from a date the bulletin gives. Lighthouse's clock: first seen at this read. No earlier read can bound it, because the baseline route failed. Limit: these statements were found only through a route replaced after the baseline outcomes were seen (amendment 1). Their own dates precede the baseline, so the reads say nothing about when they appeared.

Oracle (rule panel; new statement, class unchanged)

The security-alerts feed (Last-Modified Mon, 02 Nov 2026 09:37:52 GMT) now carries "Oracle Security Alert Advisory for CVE-2026-109618 and CVE-2026-109619", pubDate Mon, 26 Oct 2026 13:00 -0700. At the baseline the feed's newest item was dated 24 October and it named neither CVE. A second new item, a Security Alert for CVE-2026-114820 dated 30 October, is outside this study. The alert (https://www.oracle.com/security-alerts/alert-cve-2026-109618.html, Last-Modified 31 Oct 2026 06:33 GMT) was added to panel.json and fetched once.

  • Revisions: "2026-October-25 Rev 1. Initial Release."; "2026-October-26 Rev 2. Added Oracle Secure Backup".

  • Affected, each with "new security patches" through a Patch Availability Document (not opened; the documents are on Oracle's support site):

    • Oracle Communications: Diameter Signaling Router 8.6.0 and 9.0.0; EAGLE Application Processor 17.0 and 17.1; EAGLE Element Management System 47.0; EAGLE LNP Application Processor 11.1; LSMS 14.0; Performance Intelligence Center (PIC) Software 10.4 and 10.5; Unified Assurance 6.1.1 to 7.0.0; User Data Repository 15.0;
    • Oracle Secure Backup 19.1.0.0.0 to 19.1.0.1.0;
    • Oracle Solaris 11.

    Each is scored CVSS 3.1 9.8, remotely exploitable without authentication. The component is given as "(PHP)", for example "Utility (PHP)" for Solaris. "The patch for CVE-2026-109618 also addresses CVE-2026-109619."

  • Quoted: "Oracle strongly recommends that customers apply the available security patches without delay. The Security Alert advisory will continue to be updated as additional product patches become available."

  • Exploitation: none stated.

  • PHP branch: not stated.

Oracle's class: affected, fixed for all listed, unchanged. The alert lists a patch for every product it names. The Oracle Linux errata of 21 and 22 October are unchanged.

Clocks. Vendor's clock: the alert was first released on 25 October (4 days after PHP's releases) and revised on 26 October. Lighthouse's clock: in the feed after 2026-11-01T14:20Z (the baseline, without it) and at or before 2026-11-02T15:30Z. Limit: the alert's own date precedes the baseline. The feed added it, or it reached the feed, after that date, so the read bounds when the feed carried it, not when Oracle published it.

Named stratum

Vendor Route Class Change PHP branch stated
Splunk advisories list and SVD-2026-1013: read, both identical bytes affected, fixed for all listed none not stated ("a fixed version")

Flags

  • Newly stated PHP branch: yes, Google. Its Apigee bulletin states PHP 8.3 (8.3.36) for the Kickstart developer portal images, and "PHP 7.3 or 7.4" for Apigee Edge for Private Cloud Drupal 7 and 9 portals. The second is a pair of branches PHP's 21 October releases do not fix, and the bulletin says no packaged fix is available. Google's blog also names PHP 5.5, 7.2, 7.3, 7.4 and 8.1 runtimes as left unpatched. This is the first vendor in the panel to state a branch. Before it, the only branch on record was PAN-OS's PHP 8.0.30, and that is Dream Research's account, not Palo Alto Networks'.
  • Vendor statement of exploitation: none at this read. No vendor says a product of its own was exploited. Cisco, Fortinet and Splunk still say they know of none, and Palo Alto Networks' claim stays in LH031's record. The nearest sentence is Google's blog: Mandiant is "hunting for evidence of intrusion activity related to this campaign". That presumes a campaign but names no victim or product, and is recorded as quoted. A reviewer may want to weigh whether it counts.
  • Not checked: Oracle's Patch Availability Documents and the fixed builds they name; whether Google's Kickstart images contain PHP 8.3.36; Ivanti's community advisory portal, which its blog feed may not mirror.

Next read: 5 November (row LH037-2026-11-05).

From studies/LH037/checkpoints/2026-11-02T1530Z.md in the repository, last changed 2 November 2026.