Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

R-0037: Recheck of the resolutions to R-0035 and R-0036 (PHP account, version 1.2)

I am a Claude Code review subagent on Claude Opus 5.5, dispatched by the driving session on 27 October 2026. This is the one fresh reading AGENTS.md (step 4) asks for of what the driving session wrote to resolve the evidence review (notes/R-0035-php-cisa-evidence.md) and the reader-and-inference review (notes/R-0036-php-cisa-reader.md). It is not a chain: my own changes are listed below and go to no further reader. No key or token was read from the environment, no search touched harbour/.session/, nothing was fetched from the network, and nothing was committed or pushed. Cost: unknown at the time of writing; to be priced by the driving session from the transcript with harbour/hb tokens --latest.

What I read

  • AGENTS.md: step 4, "Rules that matter", "Evidence" and "Writing".
  • Both review notes in full, including each "Resolution, by the driving session" section.
  • The resolutions: git diff --word-diff=plain 034ffb2 5a56694 -- articles README.md investigations programme.md observations.md studies/LH031/LH031.md studies/LH031/checkpoints notes/php-watch-log.md (commits 1eb8747 for R-0035 and 5a56694 for R-0036).
  • In context: articles/php-emergency-first-reading.md and articles/short/php-emergency-first-reading.md in full; README.md above its first rule; the 27 October paragraph and the 22 October attack checkpoint in programme.md.
  • The retained files: studies/LH031/data/read-2026-10-27T0633Z/ (feed.raw, read_log.json, result.json) and read-2026-10-26T1830Z/, parsed with the standard library under python3 -I, printing each body's size, SHA-256, catalogVersion, dateReleased, count and top-level keys, the full entries for CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560, every URL in the two entries' notes, and the set difference of identifiers between the two reads; the read logs of all twelve reads under studies/LH031/data/; studies/LH031/brief.md (the "reliable evidence" wording, SOCRadar's report and the amendments); studies/LH031/checkpoints/; studies/LH028/LH028.md (the Amazon and Cloudflare rows and limits).

What I checked

  1. The two entries' notes. Each cites exactly five links: https://www.php.net/, CISA's alert of 21 October (.../alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching), BOD 26-04, BOD 26-04's implementation guidance (labelled "Forensics Triage Requirements") and the CVE's NVD page. None is presented as a source for exploitation. So "the entries' notes cite only PHP's site, CISA's own 21 October alert, its directive's pages and NVD's records" (article), "php.net, CISA's 21 October alert, BOD 26-04 and its implementation guidance, and NVD's records" (record) and "cite no source for exploitation" on each surface hold at the certainty stated, with the caveat under "Left for the driving session".
  2. Bytes. The 27 October body is 1,810,928 bytes, SHA-256 653c72ea...fa13, matching its read log; version 2026.10.26, released 2026-10-26T22:24:24.6101Z, 1,758 entries; the top level holds only title, catalogVersion, dateReleased, count and vulnerabilities, so the feed states no criteria. Both entries carry dateAdded 2026-10-26, dueDate 2026-10-29, forensicTriage "Yes", knownRansomwareCampaignUse "Unknown". CVE-2026-115560 is absent as a parsed entry and as a byte string. Against the 26 October 18:34:59 UTC read (version 2026.10.23, 1,756 entries), the only identifiers added are the two, and none was removed. All twelve read logs exist, the first starting 18:45:46 UTC on 23 October and the last 06:34:14 UTC on 27 October, so LH031's new header line and observations.md's "twelve reads" hold.
  3. What nothing may say. No surface says or implies that CISA saw attacks, that any attempt succeeded, that a named system was compromised, or that the unlisted flaw was not exploited. Every surface that says CVE-2026-115560 is not listed adds that the absence is not evidence it has not been exploited (article notice and dated list, short form) or not a negative finding (programme). "May rest on the same reports" is stated as a possibility everywhere. LH028 supports "reports of attempts": Amazon's honeypot attempts and Cloudflare's targeted traffic, each with no successful compromise in the record.
  4. Consistency across surfaces. Article summary, front page, notice, attack-reports section, dated list, short form, investigation page, programme paragraph and LH031's Answer all use "classification ... by criteria the feed does not state" and the same limits. Before this recheck the programme paragraph alone lacked the "does not show that any attempt succeeded" clause that the R-0036 resolution says every surface carries; fixed below. The summary and front page carry "not a count of attacks or proof that any succeeded" but not "may rest on the same reports"; that is a summary's compression, not a difference in certainty.
  5. Coherence of the article. The 27 October notice stands above the 23 October notice; "The further flaw PHP described on 23 October, CVE-2026-115560, below" points correctly to it; both notices and the short form link to #what-changed-after-22-october, and the heading occurs once. The reordered notice left the due-date sentence's "It" and "its directives" attached to "the listing" rather than to CISA; fixed below. The attack-reports sentence tripped when read aloud ("classification, by criteria ... and published without"); fixed below.
  6. The R-0035 settlements as written. "For the agencies its directives cover" (S1), "names no system as compromised" (S3), the header (S4), the observations row (S5), "the catalogue reads" (S6), "By its own dates, since 26 October" (O1), the read-log link (O2) and the quoted title (O3) are in place and match the bytes. LH031's Limits accurately say the brief describes an entry as CISA's judgement of "reliable evidence" (brief, line 7) and that no retained source supports it.
  7. Writing rules. A scan of every added line in the diff for U+2013 and U+2014 found none, and none of the common American spellings; "catalogue" throughout, with "Catalog" only inside CISA's quoted title.

Changes made by this recheck

  1. articles/php-emergency-first-reading.md, 27 October notice. Old: "It gives each a due date of 29 October for the agencies its directives cover." New: "CISA gives each a due date of 29 October for the agencies its directives cover." Why: the R-0036 resolution inserted a sentence ending "and it does not show that any attempt succeeded" just before this one, so "It" and "its directives" now read as the listing's, not CISA's.
  2. articles/php-emergency-first-reading.md, "What the attack reports do and do not count". Old: "That is a government agency's classification, by criteria the feed does not state and published without its evidence or a count." New: "That is a government agency's classification by criteria the feed does not state, published without its evidence or a count." Why: the resolved sentence joined a "by" phrase and a participle with "and" after a comma and trips when read aloud; meaning unchanged.
  3. programme.md, "Later evidence, 27 October 2026". Old: "so the listing may rest on the same reports of attempts already described, and an absent entry is not a negative finding." New: "so the listing may rest on the same reports of attempts already described and does not show that any attempt succeeded; an absent entry is not a negative finding." Why: the R-0036 resolution says the programme paragraph carries the same point at the same certainty as the article; it carried the "same reports" half but not the "no success shown" half that the article, short form and investigation page state.

Left for the driving session

  • "Cite no source for exploitation" rests on links, not their contents. The 21 October CISA alert the entries cite is not retained, so the claim means that none of the five links is offered as a source for exploitation. The alert predates the listing and, by SOCRadar's unopened report in the brief, said CISA had not observed exploitation, so the wording stands. If the proposed one-off read of the alert (R-0036, Next step) finds that it reports exploitation, the notice, attack-reports sentence, dated list, short form, investigation page, programme paragraph and LH031's Answer must change together.
  • "The feed" is not introduced in the short form, the summary or the front page ("criteria its feed does not state"). It is accurate, since only the feed was read and CISA's web pages may state criteria, so I did not change it; "its published data feed" would help a reader who has never heard of one.
  • R-0036's readability points were not answered in its resolution: the short form's closing "its evidence" still links only LH028, not LH031; "marked for forensic triage" still has no context (21 of the 28 October 2026 entries carry it, R-0036); the CISA caveat now appears three times in the article. None is a must-fix; the resolution should say whether each was taken.
  • Records left with the earlier wording, outside the resolved text: studies/LH031/checkpoints/2026-10-27.md still says the due date is CISA's instruction to "the agencies its directive binds", and its "Flagged for review" paragraph calls the listing "a new kind of evidence beside those two", the framing R-0036's M1 replaced on the public surfaces. Being dated run records, they may stand, but a one-line pointer to R-0035 S1 and R-0036 M1 would stop a later writer quoting them.
  • observations.md's PHP row still names "LH018 to LH029" in its source column while its period column now cites LH031.
  • At release: AGENTS.md's PHP bullet and releases.md (R-0035, S7).

What the driving session did with what was left

27 October 2026, after this recheck, before release. Each change narrows or tidies; none adds a new claim beyond the retained files.

  • "Cite no source for exploitation": the entries do link CISA's own 21 October alert, which this container's readers could not open, so the phrase overstated what was read. Every surface now says the entries "link no exploitation report we could read", and the article's notice and the programme paragraph name the alert as the one CISA link and say it refuses our reader; LH031's record says the same.
  • "The feed" not introduced: the summary, front page, short form and investigation page now say "by criteria the catalogue does not state".
  • R-0036's readability points: 1 taken (the short form's closing link names both the attack accounts and the catalogue reads); 2 taken in part (the attack-reports sentence keeps the caveat in one sentence and links to the dated list for the fields, not repeating them); 3 taken (the dated list says 21 of the 28 entries the catalogue dates October 2026 carry the forensic-triage flag, recomputed by the driving session in studies/LH031/review/triage_count.py and .txt).
  • LH031's 27 October checkpoint: "the agencies its directive binds" now reads "the agencies its directives cover"; "a new kind of evidence" now reads "a different kind of record beside those two, whose own sources are not given".
  • observations.md: the PHP row's study range now reads LH018 to LH031.
  • AGENTS.md and releases.md: updated at release.

Cost of this recheck, from its transcript (harbour/hb tokens --latest): $0.73 at list rates (Opus 5.5).

From notes/R-0037-php-cisa-recheck.md in the repository, last changed 27 October 2026.