Close-out, 27 October 2026: CISA's listing in the PHP account

What was learned. CISA's catalogue of known exploited vulnerabilities, version 2026.10.26 (released 26 October 22:24 UTC), lists CVE-2026-109618 and CVE-2026-109619, each dated 26 October with a due date of 29 October; CVE-2026-115560 is not listed (studies/LH031/LH031.md, version 0.2). The entries link no exploitation report Lighthouse could read: their notes cite php.net, CISA's 21 October alert (which refuses this container's readers), its directive's pages and NVD.

What changed in the current account. The PHP account went to version 1.2, a second "Later evidence" notice with no correction: the listing is CISA's classification by criteria the catalogue does not state, not a count of attacks or proof that any succeeded, and may rest on the same reports of attempts the account already describes. The front page, short form, investigation page, programme, observations.md and AGENTS.md say the same.

What remains uncertain. What evidence CISA relied on; whether any attempt succeeded anywhere; whether CVE-2026-115560 has been exploited (an absent entry says nothing).

Next outward question. LH033's week-one piece, scheduled for 30 October, compares how far the fix has reached by others' counts with the Python findings; it will not tie any change after 29 October to CISA's due date. A candidate LH031 amendment: one retained read each of CISA's catalogue criteria and its 21 October alert.

Spend, at list rates. Evidence review (Fable 5.1) $2.56; reader review, both stages (Opus 5.5), $0.73; recheck (Opus 5.5) $0.73; driver since 07:00 UTC $4.3293 (harbour/hb drivercost). The morning's daily run, before this round, is priced in its own commit.