Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH037

LH037 checkpoint: first Thursday read, 5 November 2026, 14:14 UTC

Protocol 0.1 with amendment 1 (2 November; Google's, Ivanti's and Citrix's routes replaced). Read data/read-2026-11-05T1414Z/: 31 GETs, 23 routes and the 8 statements recorded by 2 November, 14:14:53 to 14:15:12 UTC (read_log.json). Every body with a CVE or PHP mention was opened and its text compared with the same body at the read of 2 November; bodies without a mention were compared too. Then the three pages Google's feed linked for the first time were added to panel.json's advisories and fetched once by collect.py --found, 14:23:57 to 14:24:00 UTC (found_log.json). Compared with the read of 2 November, 15:30 UTC. Every statement below is the vendor's own, as read; nothing was checked against a product. Writer: a Claude Code subagent of the scheduled run of 5 November 2026 (run 2026-11-05T1414Z, Claude Opus 5.5); unreviewed.

Rule panel (20 vendors)

Vendor Route at this read Class Change since 2 November PHP branch stated
Microsoft update guide API, both CVEs: HTTP 200, 134 bytes, identical bytes unavailable (by the brief's 200-byte rule) none. Second reading, as the amendment requires: the body is still a well-formed empty answer ("@odata.count":0), so Microsoft's guide lists no product for either CVE —
Apple security releases list: read, identical bytes no statement found none —
Cisco ⚑ PSIRT feed and cisco-sa-php-october26-Jj384Daq: read; advisory identical bytes affected, fixed for some none (advisory still version 1.10 Final, last updated 2026-10-30 19:24 GMT). The feed's PHP item now carries a CVE: line naming both CVEs, with the same date (2026-10-30 19:24:31); its text is otherwise unchanged. New feed items (eMudhra, Secure Email Gateway, UCS Central and others) do not name these CVEs not stated
Google Google Cloud security bulletins feed: read (Last-Modified 4 Nov 2026 21:06 GMT); Apigee bulletins page and blog read affected, fixed for some revision and new statements, class unchanged: GCP-2026-070 now shows "Updated: 2026-10-28" with a dated update note, and links three release-notes pages, added and fetched at this read (below). GCP-2026-072 and the blog post are unchanged in text same branches as on 2 November; the release notes add dated runtime builds (below)
Ivanti Security Advisory blog feed: read, identical bytes no statement found none —
Fortinet ⚑ PSIRT feed, FG-IR-26-186 and its CSAF: read, all three changed affected, fixed for some investigating → affected, fixed for some. The advisory, updated 5 November, adds FortiSOAR and FortiSOAR PaaS as affected, with fixed and upcoming releases, and lowers its severity from Critical to Medium (below) not stated
Adobe bulletins page: HTTP 403, "Access Denied" (refusal; only the reference number differs) unavailable none (not replaced; amendment 1) —
Linux no route no route — —
Oracle Oracle Linux CVE pages, security-alerts feed and the alert: read affected, fixed for all listed none. The feed is identical bytes. The alert's Last-Modified moved to 4 Nov 2026 22:30 GMT, but only its site navigation changed; the revision history still ends at Rev 2 (2026-October-26). The Oracle Linux pages' text is unchanged not stated
Apache no route no route — —
Citrix support.citrix.com/securitybulletins/: HTTP 200, 8,422 bytes, identical bytes, body "Loading..." (script-rendered) unavailable none (the one replacement is used) —
D-Link announcements: read, identical bytes no statement found none —
Palo Alto Networks ⚑ feed: read; its URL for CVE-2026-109619: HTTP 404, identical bytes affected, fixed for some none from LH037's routes. The PHP item is unchanged (pubDate 2026-10-29T23:54Z); the feed's other items were reordered. The advisory itself is LH031's (amendment 5); LH031's checkpoint of this run reads it as unchanged in every extracted field not stated by the vendor; PHP 8.0.30 by Dream Research's account (R-0044)
Synacor Zimbra Security Center: read, text unchanged no statement found none (its five "PHP" mentions are the same as at the baseline and name neither CVE) —
Android bulletins index: read, text unchanged, no mention no statement found none (weak route, as before) —
Samsung mobile security updates: read, no mention no statement found none. The page adds SMR November 2026, which does not name these CVEs —
Zyxel advisories list and statement of 28 October: read not affected none. The list adds two advisories of 3 November on other flaws; the statement's text is unchanged except for a close button —
SonicWall vulnerability list: HTTP 200, 729 bytes, a script-only page, identical bytes to the baseline's unavailable none in class. The way it fails changed back: a refusal (HTTP 410, WAF block) on 2 November, the script-only page again now. Not replaced (amendment 1) —
Roundcube news: read, identical bytes no statement found none —
VMware Broadcom advisory portal: read, text unchanged (script-rendered list) unavailable none (not replaced; amendment 1) —

⚑ partly known before the brief (brief, "What is already known"): Cisco, Fortinet and Palo Alto Networks are also in the named stratum.

At this read: 6 of the 20 vendors had a statement naming the CVEs that their routes reached (Cisco, Fortinet, Google, Oracle, Palo Alto Networks, Zyxel). 7 had none found (Apple, Ivanti, D-Link, Synacor, Android, Samsung, Roundcube). 5 were unavailable (Microsoft by the size rule, Adobe by refusal, Citrix, SonicWall and VMware by script-rendered pages). 2 have no route (Linux, Apache). The counts are the same as on 2 November. The one change of class is Fortinet's.

Changes, measure 3

Fortinet (rule panel and named stratum; class changed)

FG-IR-26-186, "PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)", now gives "Published Date Oct 21, 2026" and "Updated Date Nov 5, 2026" (Oct 28 on 2 November). Its timeline adds "2026-11-05: FortiSOAR and FortiSOAR PaaS added to impacted product list". The feed item says "Revised on 2026-11-05 00:00:00" (feed Last-Modified 5 Nov 2026 14:00 GMT).

  • Affected, with the vendor's solution for each:
    • FortiSOAR PaaS 8.0.0 and FortiSOAR on-premise 8.0.0: "Upgrade to 8.0.1 or above".
    • Both, 7.6.0 through 7.6.7: "Upgrade to upcoming 7.6.8 or above".
    • Both, 7.5.0 through 7.5.4: "Upgrade to upcoming 7.5.5 or above".
    • FortiSOAR PaaS 7.4 and 7.3, and FortiSOAR on-premise 7.4, 7.3, 7.2 and 7.0, all versions: "Migrate to a fixed release".
    • Under "Workarounds": "Security patches addressing the PHP2Shell vulnerabilities are available in FortiSOAR and FortiSOAR PaaS versions 8.0.0, 7.6.7, and 7.5.4", each linked to a "Security Patch" page on docs.fortinet.com (not opened). No date is given for any fix or patch.
  • Impact and severity: "The impact on FortiSOAR, FortiSOAR PaaS has been assessed as limited to a denial-of-service condition affecting the PHP service and the availability of the GUI only. As a result, the applicable product CVSS score is 5.3". Severity moved from Critical (CVSSv3 9.8, temporal 9.8) to Medium (5.3, temporal 5.1). The summary of each CVE lost its last sentence, which on 2 November said that multiple strategies can trigger the condition and "lead to remote code execution (RCE)" (for CVE-2026-109619, "produce remote code execution (RCE)").
  • Still under investigation: FortiDDoS. FortiSOAR and FortiSOAR PaaS left that list. FortiRecon was added to the products "confirmed NOT Impacted". The sentence "Fortinet is currently investigating the impact of these CVEs over Fortinet Products" is still on the page.
  • CVE-2026-115560, newly addressed: "No Fortinet product meets the conditions required for exploitation. Therefore, CVE-2026-115560 does not affect any Fortinet products."
  • Exploitation: the advisory's field "Known Exploited" reads "No", as on 2 November. No sentence says a Fortinet product was exploited.
  • PHP branch: not stated. It names "the PHP service" in FortiSOAR without a version.
  • CSAF: on 2 November it was a 764-byte document with an empty product tree. Now (23,891 bytes, Last-Modified 5 Nov 2026 10:11 GMT) it lists the same FortiSOAR versions as known_affected and 8.0.1, "upcoming 7.6.8" and "upcoming 7.5.5" as known_not_affected, with the impact note above. Its current_release_date is 2026-11-05; its revision history still has the single entry "Initial Publication" of 2026-10-21, at version "0".

Fortinet's class: affected, fixed for some, from its most recent statement: one fixed release (8.0.1) and patches for three versions are named as available, two releases are "upcoming", and older branches of FortiSOAR are told to migrate. The class is a reading of the advisory as a whole; the page still says Fortinet is investigating, for FortiDDoS. Clocks. Vendor's clock: first published 21 October (0 days after PHP's releases); FortiSOAR added on 5 November (15 days). No fixed release carries a date. Lighthouse's clock: the change appeared after 2026-11-02T15:30Z (the read without it) and at or before 2026-11-05T14:14Z.

Google (rule panel; revision and new statements, class unchanged)

  • GCP-2026-070 (published 2026-10-21) now shows "Updated: 2026-10-28" and opens with "2026-10-28 Update: For Cloud Run, Cloud Run functions, and Google App Engine Standard, all supported versions of PHP 8.2 and later are patched. Take immediate protective action by redeploying your resources with updated dependencies." The rest of its text is unchanged. On 2 November the feed's entries already carried an updated time of 2026-10-28T15:19Z and the feed a Last-Modified of 28 October, yet this entry had neither the date nor the note. So the note reached the feed after 2026-11-02T15:30Z and at or before 2026-11-05T14:14Z, although Google dates it 28 October. Each "Cloud Run", "Cloud Run functions" and "Google App Engine Standard" in that sentence links a release-notes page at its #October_22_2026 entry.
  • The three release-notes pages, added to panel.json as cloud-run-release-notes, cloud-run-functions-release-notes and appengine-php-gen2-release-notes and fetched once (none names either CVE; all link the blog post):
    • 21 October (each page): patch updates to supported PHP runtimes "8.5.12, 8.4.27, 8.3.36, and 8.2.35". Cloud Run said resources, and Cloud Run functions said functions, with automatic base image updates enabled "have already been patched"; App Engine said "PHP workloads have automatically been patched". Each 21 October entry now begins "This note is incorrect; follow guidance in the entry for October 22, 2026."
    • 22 October (each page): "All supported versions of PHP 8.2 and later are patched. Take immediate protective action by redeploying your resources with updated dependencies."
    • 24 October (each page): runtime security updates for "PHP 8.2 and later: 8.2.35, 8.3.36, 8.4.27, 8.5.12"; on Cloud Run and Cloud Run functions within an entry covering several languages; on App Engine with the stacks google-22 and google-24 also updated.
    • Exploitation: none stated.
  • GCP-2026-072 (Apigee): the feed entry's text is unchanged, as is the bulletin on Apigee's page. The page's "Last updated" moved from 2026-10-26 to 2026-11-05 UTC because it added GCP-2026-077 (eMudhra). Blog post: text unchanged; only its related-articles list changed.
  • New feed entries GCP-2026-075 to 078 concern other flaws. GCP-2026-075 names PHP only as a language whose gRPC package bundles a trust store.

Google's class: affected, fixed for some, unchanged; its most recent statement on these CVEs is still GCP-2026-072 (24 October). PHP branch (measure 4): no newly stated branch. The serverless runtimes' branches, PHP 8.2 and newer, were stated in the blog on 2 November; the release notes add the fixed runtime builds 8.2.35, 8.3.36, 8.4.27 and 8.5.12 with Google's dates of 21, 22 and 24 October. Clocks. Vendor's clock: first fixed runtime builds named 21 October (0 days), with Google's own correction on 22 October that redeploying is needed. Lighthouse's clock: first seen at this read. Limit: the release-notes pages were found through a link that first appeared at this read, and their entries' own dates precede the baseline, so the reads say nothing about when those entries appeared.

Named stratum

Vendor Route Class Change PHP branch stated
Splunk advisories list and SVD-2026-1013: read; advisory identical bytes; the list's SVD-2026-1013 row unchanged (published 2026-10-22, modified 2026-10-26), only other rows' dates changed affected, fixed for all listed none not stated ("a fixed version")

Flags

  • Vendor statement of exploitation: none new at this read. No vendor read through LH037's routes says a product of its own was exploited. Fortinet's advisory still says "Known Exploited: No", and now says no Fortinet product "meets the conditions required for exploitation" of CVE-2026-115560. Cisco and Splunk say no more than on 2 November. Palo Alto Networks' statement that "active exploitation has been observed" stays in LH031's record, which reads it as unchanged at this run.
  • Newly stated PHP branch: none. Google's release notes restate PHP 8.2 and newer for its serverless runtimes with dated builds; Fortinet names no PHP version for FortiSOAR.
  • Class change: Fortinet, investigating → affected, fixed for some (FortiSOAR and FortiSOAR PaaS), with its own impact assessment of denial of service only.
  • Not checked: Fortinet's FortiSOAR security patch pages on docs.fortinet.com and whether FortiSOAR 8.0.1 is released and when; which PHP version FortiSOAR carries; Oracle's Patch Availability Documents; whether Google's runtimes in fact carry the builds named; Ivanti's community advisory portal, which its blog feed may not mirror; Palo Alto Networks' advisory, which this checkpoint takes from LH031's checkpoint without re-reading. Links from a recorded advisory (Fortinet's patch pages, as Oracle's documents on 2 November) were not added to panel.json; links from a route (Google's feed) were, as the brief's "Advisories found" says.

For the commit message

LH037 read of 5 November: 6 of 20 vendors have a statement naming the CVEs, as on 2 November. One class changed: Fortinet moved from investigating to affected, fixed for some, adding FortiSOAR and FortiSOAR PaaS on 5 November (8.0.1, upcoming 7.6.8 and 7.5.5, patches for 8.0.0, 7.6.7 and 7.5.4, migrate for older branches), with its own assessment that the impact is denial of service only (Medium, 5.3, down from Critical, 9.8). Google revised GCP-2026-070 (update dated 28 October, first seen at this read) and its three linked release-notes pages were added to panel.json. No vendor statement of exploitation and no newly stated PHP branch at this read. Nothing found changes a claim in the public PHP account (articles/php-emergency-first-reading.md) or the week-one piece (articles/a-week-after-two-fixes.md): neither names Fortinet, Google's runtimes or any panel vendor's fix besides Palo Alto Networks', which did not change. If a later revision of either piece describes vendors' own copies of PHP, Fortinet's assessment that FortiSOAR's exposure is denial of service only, and Google's note that its 21 October "already patched" release notes were "incorrect", are the two items a reviewer may want to weigh.

From studies/LH037/checkpoints/2026-11-05T1414Z.md in the repository, last changed 5 November 2026.