Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

PHP discovery pass, 23 October 2026: triage ledger

Under the fixed plan (commit 950e643, pushed 17:07:32 UTC), six searches were made at about 17:08 UTC (ranked results as returned) and two first-party pages were opened directly at 17:08:45 to 17:08:46 UTC (read log; raw bytes in pages/, verified by python3 notes/php-discovery-2026-10-23/replay.py). The pass then stopped, as the plan requires; six of the eight allowed pages were unused because no other result was a first-party page about this event. Nothing here is a coverage measure. Each claim below is the named source's, as read; none was verified against its own primary source in this pass.

Opened pages

Source and read Source's own clocks Claims, as the source makes them New against what was known Measurable boundary Access gap Decision
CybelAngel, "2.24M Internet-Facing PHP Hosts, 59% on Versions With No Fix Coming" (page), read 17:08:45 UTC, HTTP 200, 169,023 bytes, SHA-256 2e7d2f11...6621 article:published_time 21 October 10:48:54 UTC, article:modified_time 21 October 18:14:34 UTC About 2.24 million internet-facing hosts advertise PHP, and 883,717 of about 1.5 million that report a version run a branch with no official release, "from Shodan banner counts published by Mallory on 20 October 2026", counting hosts, not organisations or websites; about 740,000 hide their version; backports mean some old-version hosts may be patched. Its own scan of 1.3 million assets after the release found 54 per cent of version-revealing sites on an end-of-life branch. Release at "about 13:35 UTC" (citing Help Net Security); a Cloudflare executive reporting early attacks at 07:43 UTC and Aikido reporting exploitation at 09:18 UTC, both on 21 October; WordPress hosts "reportedly" disabling session upload progress on 21 October (citing The Repository). An exposure count with a stated unit, numerator and denominator, but second-hand (Shodan banners via Mallory, 20 October), before the release; a fourth release clock beside CERT-EU's 13:30, Amazon's 14:00 embargo and PHP's own; a third-hand report that hosts disabled the 21 October setting. Unit: host advertising a PHP banner; versions advertised, not patch level; one 20 October count; no repeat. CybelAngel's own scan gives no method, date or denominator beyond 1.3 million assets. The Shodan and Mallory sources were not opened; reproducing banner counts needs an account a task must name. Context only. Banner counts measure advertised versions, which backports and hidden versions make unreliable for patch state; no window that brackets the fix. The cited release clocks stay with their sources.
SOCRadar, "PHP2Shell CVE-2026-109618 & 109619: Affected Versions & Fix" (page), read 17:08:46 UTC, HTTP 200, 277,344 bytes, SHA-256 98bc0196...d559 article:published_time 21 October 10:38:58 UTC, article:modified_time 23 October 12:14:31 UTC (given as +03:00 offsets) (a) Its researchers found on an exposed attacker server a lab-tested exploit chain for PHP 8.4.26 under Apache mod_php and scripts that screened about 20 public websites, none of which met the exploit's preconditions (22 October). (b) As of 23 October neither CVE is in CISA's Known Exploited Vulnerabilities catalogue, and on 21 October CISA said it had not observed exploitation. (c) Network appliance vendors confirm affected products (22 to 23 October): Palo Alto Networks PAN-OS and Panorama with no fixed release yet; Cisco Expressway rated Critical with a fixed release; Fortinet and Splunk investigating. (d) The 23 October flaw: it carries PHP's conditions and session.upload_progress.enabled=0, says "the October 21 releases do not fix" it, and that no exploitation has been reported. (a) A claimed attacker-side artifact, distinct from attempt telemetry. (b) An agency classification with a date that can be checked directly. (c) A downstream route not in LH018 to LH029: PHP embedded in vendor appliances, whose fixes come on the vendors' own clocks. (d) A third public wording of the 23 October instruction, stating the version scope PHP left implicit. (a) None measurable: the servers and sites are unnamed. (b) CISA's catalogue is a public dataset with a dateAdded field per entry: a timed, binary, agency-defined boundary for "exploited in the wild". (c) Vendor security advisories usually carry first-published and updated times and fixed-release fields: a defined vendor panel could time fixes outside PHP's own releases. The catalogue and the vendors' advisories were not opened (not results). (a) Context only. (b) Candidate measurement, small: read the catalogue's public feed for the three CVEs at fixed times. (c) Candidate measurement: a fixed panel of appliance vendors' advisories, timed by their own fields, fixed before reading. (d) Prior knowledge for the propagation brief (see below), not a finding of this pass.

Leads not opened

  • Operators' precautionary actions (query 4, media only): Dutch government services (Overheid.nl, MijnOverheid.nl, DigiD) suspended, with no indication of exploitation reported; Finnish public web services taken offline; French local-government administrative sites taken down; BambooHR temporarily offline; game services in emergency maintenance, some links unconfirmed; Luxembourg's CIRCL advising operators to check the running version and restart every PHP process. Candidate measurement, weak: these operators were chosen by press salience, and LH027's one operator notice refused a direct read. A panel of operators' own status notices fixed by role before reading could time outages and restorations, but its frame would be the press's.
  • Exploitation status: the tool's summary and CybelAngel attribute in-the-wild reports to Cloudflare and Aikido; SOCRadar says exploitation was "described as broad" on 22 October without naming who described it. Context only until a sensor, unit and window are published.
  • Nothing found for attempt telemetry naming the CVEs (query 1), the exploited-vulnerabilities catalogue (query 2, third-party digests only), other honeypot operators (query 5) or packaging and CI problems (query 6). These are results of one search tool's index on one evening, not absences.

For the propagation brief (Priority 3)

The plan kept the 23 October instruction out of every query. The SOCRadar page was opened for its exposure and telemetry content, as the highest-ranked first-party result of query 3, before its text was known; its update carries the instruction. Its outcome is therefore known, as PHP's and Cloudflare's are (studies/LH029), and any brief must disclose it or leave SOCRadar out of its frame. CybelAngel's page, last modified on 21 October, predates the instruction and does not carry it. The pass saw no other page carrying it.

What the pass changes

No reader update follows from it: nothing opened bears on the 22 October account's claims at a certainty that would change them. Two candidate measurements are new and bounded, the exploited-vulnerabilities catalogue's dated entries and a vendor-appliance advisory panel, beside the propagation question the continuation plan prefers. The pass's main limit is the search tool: two queries naming the CVE identifiers returned almost nothing that named them, while plain-language queries returned many articles, so what a pass finds depends on wording as much as on what exists.

From notes/php-discovery-2026-10-23/ledger.md in the repository, last changed 23 October 2026.