Short forms
Each piece in a few paragraphs, written to stand alone, with the full piece linked beside it.
-
Short Who watches the internet?
We read the public pages of 48 instruments that watch the internet itself and publish at least some data free, in November 2026. Every one of ten layers had at least one, by what we found, but none saw the whole of its layer, and 11 of the 48 build on another.
Published · Released · Full piece
-
Short A week after two fixes
A week after the PHP and Node.js fixes of 21 October 2026, every fixed Node.js line and PHP branch had passed half in the two counts we followed each day, while more than half of the PHP services showing a version ran branches PHP no longer fixes.
Published · Released · Full piece
-
Short The PHP patch was public on Wednesday; one reported attack trace is older
Amazon reports a pre-disclosure PHP exploit attempt against a honeypot. The early response has left visible traces in protection rules and published images, but not a count of affected or fixed sites.
Published · Later evidence 30 October 2026 · Full piece
-
Short When a Python project pins a library, its test and build workflows almost always install what the pin names
If a Python project keeps a pin or a lockfile, do its automated tests install from it? At 469 moments from April 2025 to August 2026 when one of 332 projects held an older version of a widely used library in a pin or lockfile, 395 kept test and build workflows, and where our rules could decide, some job installed the library from the pinned file at 282 of 291 of those moments. Where a lockfile held the version, a job read it at 164 of 188, though at 83 only through commands that can rewrite it. A workflow is not a run.
Published · Released · Full piece
-
Short When a Python project pins a library, the container recipe it keeps mostly installs what the pin names
If a Python project keeps a pin or a lockfile, does the recipe that builds its software read it? At 469 moments from April 2025 to August 2026 when one of 332 projects held an older version of a widely used library in a pin or lockfile, about half kept a container recipe, and where our rules could decide, the recipe installed from the pinned file for 129 of the 167 projects at those moments, but for 21 of 37 where only a lockfile held the version. More than a quarter could not be decided, and a recipe is not an image anyone built or ran.
Published · Released · Full piece
-
Short Further down Python's download rankings, fewer libraries' new versions take half the downloads in two days
Of the fifty most downloaded Python libraries, 37 put out new versions between April and August 2026, and for 26 of them most of those versions were half of the library's downloads within two days. Further down the rankings it was so for fewer libraries: about half of the 52 that released, of 80 drawn at random from ranks 51 to 500, and about a quarter of the 35 that released, of 80 drawn from ranks 501 to 5,000, for new versions released April to August 2026. A download counts fetches, not people or machines.
Published · Released · Full piece
-
Short Most downloads of old versions come from Pythons a newer version supports
Why do old versions of a library keep getting downloaded after a new one is out? In one week of September 2026, for 32 of 37 heavily used Python libraries, fewer than half of those downloads came from Pythons too old for a newer version. For boto3, the most downloaded, most did, yet their counts look like versions an installer tried and threw away rather than installed.
Published · Later evidence 3 November 2026 · Full piece
-
Short New releases arrive quickly. Older versions keep getting downloaded.
A new version of a widely used Python library takes most of its share of the downloads on its first full day and gains only a few points more over the month, while older versions go on being downloaded: a pattern we saw in almost all of 37 big libraries, and only after the counts were in. For most of them that share passed half; for eleven, among them boto3, numpy and pandas, it did not. A download counts fetches, not people or machines.
Published · Revised 29 September 2026 · Full piece
-
Short Where does a software update go once it is released?
When a library releases a new version, how fast does the software built on it take it up? Open version ranges took one release within days; pinned software took security fixes over weeks, and whether a fix that says it mends a security flaw is taken up sooner is still unsettled.
Published · Later evidence 3 November 2026 · Full piece
-
Short Does pinned software move sooner to a security fix that says so? Added up, it leans that way; library by library, we cannot tell
Does software that pins a library move sooner to a security fix whose notes say what it is? Across thirty libraries it leans that way when every project is added up, but not when each library counts once, so the question is not settled.
Published · Revised 27 September 2026 · Full piece
-
Short Pinned software moved faster to security fixes that said so in their notes, mostly by people in the days after the release, but no larger share moved before the advisory
Nineteen of 37 security fixes said so in their own notes, eleven naming advisories not yet published. Pinned software moved to them faster across fourteen libraries, but that could not be told apart from the libraries themselves.
Published · Later evidence 27 September 2026 · Full piece
-
Short Pinned software moved to security fixes over weeks, a little faster after the release and again after the advisory, and neither drew most of the moves
Pinned software took security fixes over weeks, the typical move about nineteen days after the release, a little faster after the release and the advisory but with no burst. Every high or critical advisory we checked came after its fix was already out.
Published · Released · Full piece
-
Short Software built from open ranges took a new release within days; pinned software waited a month, and moved most often when a security advisory came
Images built from open ranges took a new release within days; pinned ones waited for the pin, and in one library six of the thirteen projects whose first move we found made it within 28 hours of security advisories published a month later. A later reading of four libraries found no such burst.
Published · Later evidence 27 September 2026 · Full piece
-
Short Published images show what software installed, and it was not always what its project had chosen
One project's published images held a new release sixteen days before its lockfile did, because the image was built from a range. Few projects publish images, and an image is an installation, not a run.
Published · Released · Full piece
-
Short Downloads show a new release taken up within two days, but not where it was installed or whether anyone ran it
A new release reached half of a widely used library's downloads within two days, carried, we think, by installers taking the newest version that fits. The log that shows it cannot say what was installed or run.
Published · Later evidence 28 September 2026 · Full piece
-
Short The xz backdoor sat in public for nearly five weeks until a slow login gave it away
A backdoor in the xz compression package was public for nearly five weeks and was found because one engineer noticed a slow login. No public source we surveyed watches the distribution pipelines it travelled through.
Published · Released · Full piece
-
Short We can see pieces of the internet's AI activity, but not how they fit together
One AI agent's small job can show up in four public counts with nothing to say they belong together. Every public view of AI activity is partial, and nobody has measured how the views overlap.
Published · Released · Full piece