SERP Poisoning & /goto?url=CAES Forensic Suite

Audit your Semrush, BrightEdge, or Ahrefs exports for September–October 2026 synthetic Google SERP swaps, or inspect encrypted CAES... Protobuf redirect wrappers directly in your browser.

The Three Torpedoes Hitting Search Telemetry (Sept–Oct 2026)

• 1. Active Synthetic SERP Poisoning: Nozzle's 27.5M–29.9M SERP study documented an 8.0% overall poisoned rate from Sept 13–Oct 9 vs 0.17% baseline, with 27%–43.5% daily peaks on Sept 27–30 and Top-10 retention collapsing from 88.5% to 20.7%. Keyword.com measured a 13.1% overall rate, 34% Sept 30 peak, and 72% disappearance rate for Top-10 domains. Cloro's upstream API benchmark recorded DataForSEO at 33.1% unpoisoned SERPs and SerpApi at 65.9%.
• 2. The /goto?url=CAES Encrypted Protobuf Tax: On August 26, 2026, Google stripped plaintext organic URLs in favor of server-side Google Tink / Protobuf tokens (CAES...), returning HTTP 200 OK with no Location header on HEAD requests and forcing 500–1,000 GET requests per multi-page SERP.
• 3. PHP2Shell (CVE-2026-109618 / CVE-2026-109619 / CVE-2026-115560) & CISA BOD 26-04: Over 50% of PHP servers on EOL branches (PHP 8.1 and 7.x) face pre-application SAPI memory corruption and emergency WAF blackouts that block AI retrieval crawlers.

Download the open-source CLI scripts: serp_poison_auditor.py and live_goto_inspector.py, or run the PHP2Shell & Semantic Scanner.