Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

PHP media sweep 2026-10-28T0630Z

kind
working record (discovery; unreviewed; not a study)
date
2026-10-28

PHP media sweep, 2026-10-28T0630Z

Sixth sweep under the fixed plan, and the third of the once-a-day schedule. Run by a Sonnet sub-agent for the driving session. Discovery only: it finds leads, measures nothing and estimates no coverage. Compared against 2026-10-24T0830Z.md, 2026-10-24T1830Z.md, 2026-10-25T0630Z.md, 2026-10-26T0630Z.md and 2026-10-27T0630Z.md, the only earlier sweep files.

  • Searches run: 2026-10-28, shortly before 06:35 UTC (shell clock read 06:35:08Z after the last page request). The six queries were sent together, in the plan's order, standard mode, one search each, no retry. The tool is US-only and English.
  • Pages read: four attempted with WebFetch, one request each; two read, two failed (HTTP 403). All fell at about 06:35 UTC. Nothing was saved.
  • Comparison: by normalised URL (scheme, leading "www." and trailing slash dropped) against every URL in the five earlier sweep files. 56 distinct URLs returned today; 13 are new, 43 repeat. Most of the 13 are old advisories or unrelated older articles.

Results as returned

Titles are as the tool gave them. [new] marks a URL in no earlier sweep file.

1. PHP vulnerability exploited in the wild

  1. From zdnet.com: https://cert.bournemouth.ac.uk/?p=5514
  2. Exploits in the wild for several PHP-based web apps: https://isc.sans.edu/diary/954
  3. (same title) https://dshield.org/diary/954
  4. Web Sites Open to Attack From PHP Scripting Holes: https://adtmag.com/articles/2012/05/08/php-scripting-holes.aspx
  5. [new] Multiple vulnerabilities in PHP: https://cybersecurity-help.cz/vdb/SB2023080604
  6. [new] experts warn of mass exploitation of critical php flaw cve 2024 4577: https://securityaffairs.com/175198/hacking/experts-warn-of-mass-exploitation-of-critical-php-flaw-cve-2024-4577.html
  7. PHP2Shell Exploitation: Two Critical PHP Flaws Explained: https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation
  8. [new] php cgi exploit is in the wild get protected asap: https://blog.willchatham.com/2012/05/08/php-cgi-exploit-is-in-the-wild-get-protected-asap/
  9. [new] php critical rce: https://securityaffairs.com/164302/uncategorized/php-critical-rce.html
  10. CVE 2012 2376: https://exploit-intel.com/vuln/CVE-2012-2376

Tool summary (lead, unread): says Recorded Future reports the two flaws (CVE-2026-109618, CVE-2026-109619) as targeted in "active exploitation attempts" after technical details leaked before PHP's 21 October release, and that Patchstack "received reports of multiple active exploitation incidents from hosting partners". The tool says it found this in one source and that the CVE numbers "look unusual". Every new result here concerns older, different flaws (2012, 2023, 2024 and 2025).

2. PHP2Shell

  1. PHP2Shell: One Upload, Full Server: https://www.varonis.com/blog/php2shell
  2. (same title) https://www.varonis.com/blog/php2shell?hsLang=en
  3. By Aamir Lakhani | October 23, 2026: https://www.fortinet.com/blog/industry-trends/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch
  4. computingforgeeks.com: https://computingforgeeks.com/?p=176644
  5. By Aamir Lakhani | 23/10/2026: https://www.fortinet.com/uk/blog/industry-trends/understanding-php2shell-vulnerabilities-and-reducing-risk-while-you-patch
  6. 1098016 wylaczone strony rzadowe php2shell: https://android.com.pl/tech/1098016-wylaczone-strony-rzadowe-php2shell/
  7. PHP ships emergency patches for critical PHP2Shell flaws: https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws
  8. www.ithome.com.tw: https://www.ithome.com.tw/news/179913
  9. [new] www.ithome.com.tw: https://www.ithome.com.tw/news/179884

Tool summary: CVE-2026-109618 and CVE-2026-109619, fixed 21 October, CVSS 4.0 9.2; PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; releases back to 5.4 affected; PHP 8.1 and older have no official release; mod_php highest risk. For exploitation the tool says "Wiz reportedly observed attack traffic before the public disclosure" and that the UK NCSC issued an urgent warning, both "per a Chinese-language report" (unread).

3. PHP session upload progress vulnerability CVE-2026-115560

  1. Nuova vulnerabilità PHP CVE-2026-115560, spegni l'upload progress: https://pasqualepillitteri.it/news/26591/php-cve-2026-115560-spegni-upload-progress
  2. CVE-2026-115560: Another PHP Session-Handler RCE: https://www.getastra.com/blog/?p=49824
  3. PHP's nightmare is far from over: new unpatched vulnerability found: https://cybernews.com/security/php2shell-attacks-php-new-vulnerabilities-found/
  4. php cve 2026 115560 session upload progress: https://www.it-connect.fr/php-cve-2026-115560-session-upload-progress/
  5. php cve 2026 115560 turn off session upload progress: https://pasqualepillitteri.it/en/news/26592/php-cve-2026-115560-turn-off-session-upload-progress
  6. vulmon.com: https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-115560
  7. PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches: https://securityaffairs.com/?p=201595
  8. (same title) https://securityaffairs.com/201595/security/php-warns-of-new-code-execution-flaw-days-after-php2shell-patches.html
  9. oss-sec mailing list archives: https://seclists.org/oss-sec/2026/q4/359

No new URLs; the same nine as 27 October. Tool summary (unread pages): informational advisory of 23 October 2026; not fixed by the 21 October releases; mitigation session.upload_progress.enabled=0 (some sources say set it as an administrative flag); three conditions (a non-default session.serialize_handler in configuration, switched to php with ini_set() before session_start(), upload progress left enabled); "PHP treats it as unlikely to be exploited and plans to fix it in its next regular maintenance release". The tool says that "as of the reporting" PHP had not published affected versions, a severity score or the root cause, that Security Affairs reports no attacks on it, and that Vulmon references a proof-of-concept the tool could not verify.

4. PHP vulnerability websites taken offline

  1. Factbox-Governments, companies take websites offline over PHP flaws: https://www.internazionale.it/ultime-notizie-reuters/2026/10/22/factbox-governments-companies-take-websites-offline-over-php-flaws
  2. Factbox-Websites taken offline over PHP risks: https://www.thestar.com.my/tech/tech-news/2026/10/21/factbox-websites-taken-offline-over-php-risks
  3. Govts, companies take websites offline over PHP flaws: https://www.koreatimes.co.kr/world/20261023/governments-companies-take-websites-offline-over-php-flaws
  4. theprint.in: https://theprint.in/world/factbox-governments-companies-take-websites-offline-over-php-flaws/3078821/
  5. nltimes.nl: https://nltimes.nl/node/92563
  6. exposure global cyber security warning cloudflare: https://www.lbc.co.uk/tech/exposure-global-cyber-security-warning-cloudflare/
  7. Critical PHP vulnerabilities force government websites offline across Europe: https://jang.com.pk/en/74964-critical-php-vulnerabilities-force-government-websites-offline-across-europe-news
  8. php patch 631972: https://www.silicon.co.uk/cybersecurity/php-patch-631972
  9. Websites pulled offline worldwide as AI finds critical security flaws: https://www.scmp.com/news/world/article/3371694/websites-go-dark-worldwide-ai-exposes-critical-security-flaws

No new URLs. Tool summary: shutdowns on 21 and 22 October mostly precautionary; the NSA said organisations unable to update should take affected systems offline; the Interior Ministry of France, ITZBund, Valtori, Czechia, Denmark's Kombit and Dutch sites named; "The National Cyber Security Centre said it had not yet detected any active exploitation" (Netherlands); Belgium's foreign ministry closed its sites "after reports of cyberattacks", while Belgium's cybersecurity centre recorded none; "Cloudflare said it saw early attacks"; the tool says sources differ on whether attacks were occurring.

5. PHP vulnerability AI discovered Gemini OpenAI Wiz

  1. OpenAI says AI found one of the biggest web weaknesses ever: https://www.forbes.com.au/?p=211107
  2. (same title) https://www.forbes.com.au/news/innovation/openai-says-ai-found-one-of-the-biggest-web-weaknesses-ever/
  3. govt websites go dark after ai discovered flaw sparks security scramble: https://www.monitor.co.ug/uganda/news/world/govt-websites-go-dark-after-ai-discovered-flaw-sparks-security-scramble-5641112
  4. kuwaittimes.com: https://kuwaittimes.com/article/52121/world/websites-go-dark-as-ai-exposes-critical-security-flaws/amp
  5. keyt.com: https://keyt.com/?p=1494579
  6. thenewstack.io: https://thenewstack.io/?p=22841241
  7. eu.36kr.com: https://eu.36kr.com/en/p/4036210178134916
  8. (title as returned, "Laptop computer engulfed in flames"): https://techcrunch.com/?p=3180197
  9. GS 3: Science & Technology (current-affairs digest): https://superkalam.com/current-affairs/22-10-2026/govt-sites-go-dark-after-ai-discovered-flaw-sparks-security-scramble-pg16-dee1a834-7eaa-4172-9794-c0625d2b515c
  10. Gemini and GPT Helped Find PHP Flaws in Up to 70% of Sites: https://fourweekmba.com/ai-gemini-and-gpt-helped-find-php-flaws-in-up-to-70-of-sites/

No new URLs. Tool summary: as on 27 October (Calif's August finding with GPT-5.6 Sol; Wiz with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; Amazon's 17 October honeypot attempt; leak a day before release). The tool notes coverage differs on whether Calif found one bug or both, and that the model names are unverified.

6. PHP vulnerability affected products vendors patch

  1. Incident Response (SecurityWeek, amp page): https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/amp/
  2. Connect with us (SecurityWeek, same article, non-amp URL; counted new by URL only): https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/
  3. [new] PHP vulnerabilities quickly patched on October 21 (AEB): https://www.aeb.com/en/magazine/articles/php-update.php
  4. [new] NSA recommends PHP patching: https://intelligencecommunitynews.com/?p=45876
  5. [new] Last revised: --: https://vuls.cert.org/confluence/x/4gDDBQ
  6. [new] PHP Arena Affected (2005 CERT vendor note): https://kb.cert.org/vuls/vendor/VU%23459565
  7. [new] PHP Vulnerabilities Response Center (PTC): https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/php2shell
  8. [new] Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0818
  9. [new] Tenable products affected by PHP < 5.5.21 / 5.4.37 (2015): https://de.tenable.com/security/tns-2015-02

Tool summary: Cisco "reviewing over 30 products and cloud services" and says "no products are known to be affected so far" (via SecurityWeek); PTC has a product-by-product response centre and is "still assessing"; AEB says its cloud solutions do not use PHP; Google Cloud "isn't vulnerable", with App Engine standard PHP runtimes updated automatically (SecurityWeek); NSA urges an inventory of PHP-dependent systems. The tool says "Exploitation activity was also reported soon after the fixes shipped" without a source. Results 5, 6, 8 and 9 are older or unrelated advisories.

Totals: 56 results (10, 9, 9, 9, 10 and 9 per query), 56 distinct URLs after normalising; 13 new, 43 repeated.

New since earlier sweeps

Thirteen distinct URLs. By query: 1 (four, all older, different flaws), 2 (one, ithome 179884), 6 (eight, counting the non-amp SecurityWeek URL, which is the same article as an earlier amp URL). Queries 3, 4 and 5 returned no new URL. The comparison was by normalised URL against every URL in the five earlier sweep files.

Which pages were opened

The plan allows four new pages: the highest-ranked new results that make a claim of fact. The four new results in query 1 are about other, older flaws and make no claim about the October 2026 flaws, so I passed over them. I took the new results that bear on the October 2026 flaws, in rank order: ithome 179884 (query 2, rank 9), AEB (query 6, rank 3), intelligencecommunitynews.com (query 6, rank 4) and PTC (query 6, rank 7). I skipped the non-amp SecurityWeek URL as the same article as the amp URL already listed. One request each, no retry. WebFetch returns a small model's answer to a prompt, not the page text, so the quotations are unverified wording.

Pages read

A. ithome.com.tw 179884

B. AEB: PHP vulnerabilities: AEB has applied security patches

  • URL: https://www.aeb.com/en/magazine/articles/php-update.php
  • Read: 2026-10-28 at about 06:35 UTC, page returned. Page's own date: 22.10.2026.
  • Claims, each reported by the page (AEB, a software vendor):
    • It reports that the PHP Foundation "issued a warning about two critical vulnerabilities in PHP" on 21 October 2026. No source named for this.
    • It reports CVE-2026-109618 and CVE-2026-109619 as rated "9.2 out of 10" on CVSS v4.0. Primary source named: php.net/archive/2026.php.
    • It reports that AEB patched its PHP-based websites and applications within minutes of the release and that "No anomalies were detected". AEB's own statement about its systems; no source named.
    • It reports that AEB's cloud solutions are not PHP-based and "were therefore never subject to the reported security risks".
  • It says nothing about exploitation and names no PHP versions. It does not mention CVE-2026-115560.

C. intelligencecommunitynews.com: NSA recommends PHP patching

  • URL: https://intelligencecommunitynews.com/?p=45876
  • Read: 2026-10-28 at about 06:35 UTC, page returned. Page's own date: 24 October 2026. Credits "Source: NSA" and links nsa.gov.
  • Claims, each reported by the page, with the primary source it names (NSA; PHP's security advisory at php.net):
    • It reports that the NSA said on 21 October that it is focusing on finding hostile actors who might exploit the flaws, which it calls "PHP2Shell".
    • It reports that "Cyber actors are likely to weaponize PHP2Shell vulnerabilities", that the NSA recommends that organisations "conduct an inventory, where feasible" of systems relying on vulnerable PHP versions, and that patching is required "across United States Government departments and agencies".
    • It reports that "PHP released their open-source software patch Wednesday, October 21, 2026" and that other vendors may publish patches later.
  • It names no versions, figures or CVE numbers, and does not mention CVE-2026-115560. The NSA's expectation of weaponisation is a forecast, not a report of exploitation.

D. PTC: PHP Vulnerabilities Response Center

Triage

Leads for the driving session (none read under a protocol):

  • The NSA's own advisory, named by page C (nsa.gov): a first-party page; its exact wording on "weaponize" and on taking systems offline (the latter from the tool's summary of query 4) is worth reading directly.
  • PTC's response centre (page D, unread) is a vendor-status lead alongside Cisco's, as in the 27 October sweep. Not a claim read.
  • The tool's summary of query 1 says Recorded Future and Patchstack report exploitation attempts and "multiple active exploitation incidents from hosting partners". This repeats the 27 October lead; still unread, and Patchstack's own report is the primary source.
  • The CVE-2026-115560 pages are unchanged from 27 October: nine URLs, none read this sweep.

Not pursued: the four older-flaw results in query 1 (2012, 2023, 2024, 2025); the 2005, 2015 and 2024 advisories in query 6; the Chinese-language page, which could not be read.

For the daily log

  • The intelligencecommunitynews.com page (24 October) reports, citing the NSA, that "Cyber actors are likely to weaponize PHP2Shell vulnerabilities" and that the NSA recommends organisations inventory systems that rely on vulnerable PHP versions: https://intelligencecommunitynews.com/?p=45876. A forecast, not a report of exploitation.
  • AEB reports that it patched its PHP websites within minutes of the 21 October release and "No anomalies were detected": https://www.aeb.com/en/magazine/articles/php-update.php. A vendor's statement about its own systems; low consequence.

Would change the public account, flag for review (primary source to be read first), all from the tool's summaries of unread pages:

  • Recorded Future and Patchstack reportedly report exploitation attempts and "multiple active exploitation incidents from hosting partners" (query 1): an exploitation claim with a stated source. The primary source is Patchstack's report.
  • A Chinese-language report is said to say that Wiz observed attack traffic before disclosure and that the UK NCSC issued an urgent warning (query 2): an exploitation claim; the source is unread and the page could not be fetched.
  • The tool says PHP had not published affected versions or a severity for CVE-2026-115560 "as of the reporting", and that PHP plans a fix "in its next regular maintenance release" (query 3): a version and fix claim for CVE-2026-115560; unread, and the repository already holds PHP's own notice (studies/LH029).

Waits for the keeper (AGENTS.md): nothing.

Limits

One search tool's ranking, on one day, in English: what it returns depends on its index and on wording, and an absence means nothing. Media restate each other; a claim repeated by many outlets is one claim. The tool's summaries are the tool's, not a reading of the pages, and are not evidence. WebFetch answers through a small model, so the quotations from pages B and C are unverified. Pages A and D were not read (HTTP 403).

From notes/php-media-sweep/2026-10-28T0630Z.md in the repository, last changed 28 October 2026.