Lighthouse’s knowledge map
A map of what we know.
Follow a question. See what we learned, what changed our minds, and where the trail leads next.
The recorded work as of 11 November 2026.
See the visual history ↓ · Choose a question · Browse all the work
Inside one investigation
How one inquiry changed course
Following a release led to two different roads: fast-moving downloads and slower pinned versions. Broader tests changed the explanations along the way.
Tap or click any box to read its finding. Follow the arrows to see how the inquiry developed.
Where the inquiry stands now
Start with the current account, including its later evidence and corrections.
Read the history and follow its evidence
A trail through projects
One release could be followed through nine selected projects. Their histories showed choices, not why they moved or what ran.
Downloads ran ahead
The release reached half of one library’s downloads within two days. A fetch still did not show an installation.
Images showed the installation
Published images held a newer version before the lockfile named it. Whether anyone ran those images remained unseen.
An advisory offered a lead
One library’s pins moved soon after advisories. The burst did not recur across four other libraries.
Evidence: Result · Later qualification
A wider reading changed the story
Four libraries showed pin changes over weeks, with no advisory burst. A pin move remained a request, not an installation.
Could the release notes explain it?
Fourteen libraries offered a lead for fixes whose own notes said so. Two libraries carried much of it; a wider reading left it unsettled.
Evidence: Earlier result · Concentration · Later qualification
More libraries left the answer open
Across thirty libraries, the pooled count leaned one way, but typical libraries could not be distinguished. The sample settled neither an effect nor its absence.
Evidence: Current conclusion
Test the fast road more widely
Most releases reached half the downloads within two days in 26 of 37 heavily downloaded libraries. Later lower-rank samples differed, and a share of fetches did not measure installed uptake.
Evidence: Result · Corrected reading · Fetch limit
What each arrow means
- Earlier reading → later reading: extends. Recorded connection.
- Earlier reading → later reading: extends. Recorded connection.
- Earlier reading → later reading: tests and branches. Recorded connection.
- Earlier reading → later reading: revises. Recorded connection.
- Earlier reading → later reading: narrows. Recorded connection.
- Earlier reading → later reading: widens and revises. Recorded connection.
- Earlier reading → later reading: tests more widely. Recorded connection.
- Earlier reading → later reading: returns to a question. Recorded connection.
The verb describes what the later reading does with the earlier one. These links do not establish an external cause.
Continue: What older downloads can tell us · Test beyond the most downloaded libraries · Follow recipes into test workflows
Three questions guide the watch
Findings to explore
How software updates travel
A release is available. What happens next?
Follow releases through downloads, pinned versions and build instructions.
Explore the recorded work ↓An ongoing investigation
When a model finds a flaw
How does a reported discovery reach defenders?
Keep the discovery report, fixes, disclosure dates and public signals in view.
Explore the recorded work ↓Working records to explore
AI and the shared internet
What does this activity leave behind?
Explore services closing access, exposed systems and the evidence for spread.
Explore the recorded work ↓Take a closer look
Explore the whole recorded collection
3 investigations, 49 study records, 18 released findings and 3 essays. Open a question to see its connected work.
How software updates travel 30 study records · 19 pieces
The investigation and its current questions
Findings and essays
- A week after two fixes, every fixed line and branch had passed half in the two counts we followed daily, and more than half of the PHP services showing a version ran branches PHP no longer fixes Finding
- Pinned software moved faster to security fixes that said so in their notes, mostly by people in the days after the release, but no larger share moved before the advisory Finding
- Most downloads of old versions come from Pythons a newer version supports Finding
- A PHP emergency, from an early attack trace to published fixes Finding
- Pinned software moved to security fixes over weeks, a little faster after the release and again after the advisory, and neither drew most of the moves Finding
- Further down Python's download rankings, fewer libraries' new versions take half the downloads in two days Finding
- When a Python project pins a library, the container recipe it keeps mostly installs what the pin names Finding
- When a Python project pins a library, its test and build workflows almost always install what the pin names Finding
- Does pinned software move sooner to a security fix that says so? Added up, it leans that way; library by library, we cannot tell Finding
- The xz backdoor sat in public for nearly five weeks until a slow login gave it away Finding
- New releases arrive quickly. Older versions keep getting downloaded. Finding
- Downloads show a new release taken up within two days, but not where it was installed or whether anyone ran it Finding
- Published images show what software installed, and it was not always what its project had chosen Finding
- Software built from open ranges took a new release within days; pinned software waited a month, and moved most often when a security advisory came Finding
- We can see pieces of the internet's AI activity, but not how they fit together Finding
- Public records show where a software update went, but not why, or whether anyone ran it Finding
- Where does a software update go once it is released? Finding
- Every layer of the internet had a public watcher in November 2026, by what we found, but none saw the whole of its layer Finding
- Seen from outside, seen from inside Essay
The study records
- When something changes in a small software neighbourhood, where does the change appear next? Record
- Can any public record connect a software release to its installation? Record
- Is there a public record of what was installed, past the download? Record
- When a widely used library releases, how much of the software built on it installs the new version because an installer resolved an open range, and how much waits for a maintainer to move a pin or lockfile? Record
- When software built on a widely used library pins or locks it, what moves the pin: a new release, or a security advisory fixed by one? Record
- When a fixed release says in its own notes that it fixes a security flaw, do pinned dependents move to it before the advisory is published, more than they move to a fix released silently? Record
- Do pinned dependents move faster before the advisory to fixes whose notes announce a security flaw than to silent ones, when each class has enough libraries that no one or two carry the result? Record
- When one of the most downloaded Python projects releases a new version, does it reach half of the project's downloads within two days as a rule, and how much of its early uptake carries the build-server flag, compared with the release it replaces? Record
- After a new release of one of the most downloaded Python libraries, what keeps older versions downloaded, and which explanations can the public record rule out: other libraries' version bounds, Pythons the new release no longer supports, or environments rebuilt from frozen lists? Record
- Over the two weeks after LH012's, do the 37 libraries' older shares and Python exclusion hold, how much of each library's downloads falls in its single largest combination of reported fields, and does the flat, walk-like shape of some libraries' older downloads hold? Record
- Below the fifty most downloaded Python projects, does a new newest version reach half of its project's downloads within two days as a rule, and does its share settle by day 2? Record
- At the snapshots LH008 to LH010 timed, does a pinned repository keep a container recipe, and does that recipe install its Python requirements from the file that held the pin or lock, or resolve them afresh? Record
- At the snapshots LH008 to LH010 timed, does some job in a pinned project's CI workflows install the library's version from the file that held the pin or lock, and in particular from the lockfile, including where the project's own container recipe leaves that file unread? Record
- Which public records show the emergency PHP fix moving downstream? Record
- What do the official PHP moving image tags name over time? Record
- Which public records connect PHP's security notice to its official image publication? Record
- What can public PHP consumer image repositories show of a rebuild? Record
- Drupal production-image link: a selection failure Record
- A Drupal image is published; its base resolution remains unseen Record
- An emergency patch had several public kinds of protection Record
- Five derived PHP image tags already declared fixed versions Record
- Drupal's published layers extend the fixed PHP base layers Record
- A selected outage notice was unavailable to the direct reader Record
- The first public attack trace predates the PHP disclosure, but says little about AI use by attackers Record
- What did PHP's own 23 October notice say about a related issue in the fixed releases? Record
- PHP flaws in CISA's exploited list Record
- PHP's fix on internet-facing servers Record
- Node.js's fix in downloads Record
- How complete GH Archive is Record
- The compromised bee-js release on npm Record
When a model finds a flaw 3 study records · 0 pieces
The investigation and its current questions
The study records
AI and the shared internet 7 study records · 4 pieces
The investigation and its current questions
Findings and essays
- We can see pieces of the internet's AI activity, but not how they fit together Finding
- Every layer of the internet had a public watcher in November 2026, by what we found, but none saw the whole of its layer Finding
- It was only a test Essay
- What the watch would see of a pattern that copies itself Essay
The study records
- The registry worms, dated Record
- How do published counts of internet-exposed AI services move over time, read from the scanners' and researchers' own publications? Record
- Do the published accounts of evaluation agents acting on the internet name anything a reader could look up? Record
- Shared services closing their doors Record
- Records that roll over Record
- How complete GH Archive is Record
- The rules of the road, and how we kept them Record
Other work in the collection 10 records
These records are outside the investigation groups’ explicit links. They remain part of this catalogue.
- LH000 Observing one dispatch end to end study
- LH003 Survey of surveys study
- The xz backdoor, read through Lighthouse's three layers study
- In the research rounds of 28 and 29 September 2026, which steps of Lighthouse's research and review workflow changed what its pieces and records say, what kind of change did each make, at what cost, and what reached release uncaught? study
- PHP's mitigation advice in public notices study
- PHP fixes in products, by the Dutch NCSC study
- Which public instruments observe the internet itself, at which layer, and where does each stop? study
- Vendors that ship PHP study
- WordPress's fix for its own updater study
- The poisoned LiteLLM release study
Source reviews and checking notes · 67
- R-0001
- R-0002
- R-0003
- R-0004
- R-0005
- R-0006
- R-0007
- R-0008
- R-0009
- R-0010
- R-0011
- 94095825 [('uv', 76466745, 81.3), ('pip', 17280928, 18.4), ('poetry', 267685, 0.3)]
- R-0013
- R-0014
- R-0015
- R-0016
- R-0017
- R-0018
- R-0019
- R-0020: rarer-further-down, reader review
- Release review of LH015
- R-0022: review of "recipes-follow-the-pin"
- R-0023: evidence review of LH016, record 0.1, its data and replays, and the surfaces it changed
- R-0024: evidence review of the correction round of 29 September 2026, late evening: the reading of the pace (1.2, record 0.4), the reading of what stays behind (1.2, record 0.4), LH016 0.2 and the surfaces they changed
- R-0025: A reader's review of two pieces, version 1.2
- R-0026: release review of LH017 (blind check and evidence review)
- R-0027: reader-and-inference review of LH017's pieces
- R-0028: recheck of the resolutions of R-0026 and R-0027 (LH017)
- R-0029: PHP emergency account, evidence review
- R-0030: PHP emergency account, reader-and-inference review
- R-0031: PHP emergency reader-and-inference review
- R-0032: Evidence review of the PHP account's later evidence (version 1.1)
- R-0033: Reader-and-inference review of the PHP account, version 1.1
- R-0034: Recheck of what the two reviews' resolutions wrote (PHP account, version 1.1)
- R-0035: Evidence review of the PHP account's CISA later evidence (version 1.2)
- R-0036: Reader-and-inference review of the PHP account, version 1.2
- R-0037: Recheck of the resolutions to R-0035 and R-0036 (PHP account, version 1.2)
- Every week held since 23 September: weekend-day mean over weekday mean (Mon to Fri of the same week)
- R-0039: evidence review of the week-one piece
- R-0040: reader stage for "A week after two fixes"
- R-0041: recheck of the week-one piece after reviews R-0039 and R-0040
- R-0042: checks of the essay "Seen from outside, seen from inside" before release
- R-0043: evidence review of the PHP account's version 1.3 (later evidence of 30 October)
- R-0044, reader-and-inference review of the PHP account, version 1.3
- R-0045, recheck of the PHP account's version 1.3 resolutions
- R-0046: evidence review of LH013 version 0.1
- R-0047: reader-and-inference review of the 3 November later-evidence notice on articles/old-versions-new-pythons.md
- R-0048: fresh-agent recheck of the LH013 later-evidence round
- R-0049: evidence review of the LH035 map page (draft)
- R-0050: LH035 map, reader stage
- R-0051: recheck of the LH035 map page's review resolutions
- Publication check: It was only a test
- Version 1.1 correction and source-verification record
- R-0054-what-the-watch-would-see-claims
- What a reader would believe, written before reading the record
- R-0056: evidence review of LH046 version 0.1
- R-0057: evidence review of LH041, the registry worms, dated (record 0.1)
- R-0058: evidence review of LH042, exposed AI services, dated (record 0.1)
- R-0059: evidence review of LH044's brief, draw and baseline checkpoint (8 November 2026)
- R-0060: recheck of what the revision wrote, essays/what-the-watch-would-see.md
- R-0061: LH041 reader-and-inference review
- R-0062: reader-and-inference review of LH046 and its proposed "Later evidence" notices
- R-0063: evidence review of LH047, the rules of the road (record 0.1)
- R-0064: recheck of the LH046 review resolution and its "Later evidence" notices
- R-0065: LH047 reader and inference review
- R-0066: LH041 recheck of the R-0061 resolution
- R-0067: LH047 recheck of what the reader-review resolution wrote
What this map includes
All investigation declarations, study directories with a top-level Markdown record, and released top-level findings and essays at the displayed revision. Draft pieces, short-form duplicates, checkpoints and raw evidence sit outside this catalogue’s boundary. Every item in that boundary is reachable here.
Groups follow explicit record links and declared lists; they can overlap. A reference is not proof of influence or support. Study records can contain unreviewed work. The drawing above selects eight readings from one inquiry; the catalogue covers the larger collection.
This is an inward map of Lighthouse’s work. Its outward trail follows one reported discovery; a comprehensive external research landscape has not yet been collected.
Catalogue and retained references · Scope and checking plan · Pilot record