Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

PHP media sweep 2026-11-02T1526Z

kind
working record (discovery; unreviewed; not a study)
date
2026-11-02

PHP media sweep, 2026-11-02T1526Z

Ninth sweep under the fixed plan, and the first of the Monday and Thursday schedule (plan, change of 30 October 2026). Discovery only: it finds leads, measures nothing and estimates no coverage. Compared against every earlier sweep file: 2026-10-24T0830Z.md, 2026-10-24T1830Z.md, 2026-10-25T0630Z.md, 2026-10-26T0630Z.md, 2026-10-27T0630Z.md, 2026-10-28T0630Z.md, 2026-10-29T0630Z.md and 2026-10-30T0630Z.md.

  • Searches run: 2026-11-02, from about 15:27 UTC. The six queries were sent in the plan's order, standard mode, one search each, no retry. The tool is US-only and English.
  • Pages read: four attempted with WebFetch, one request each, at about 15:28 UTC; two read, two refused or failed (one HTTP 404, one HTTP 403). Nothing was saved.
  • Comparison: by normalised URL (scheme, leading "www." and trailing slash dropped) against every URL in the eight earlier sweep files. 80 results returned (10, 7, 7, 16, 20 and 20 per query); 79 distinct URLs (silicon.co.uk appears under queries 4 and 6); 10 are new, 69 repeat.

Results as returned

Titles are as the tool gave them. [new] marks a URL in no earlier sweep file.

1. PHP vulnerability exploited in the wild

  1. [new] hackers exploit critical php flaws in the wild: https://ia.acs.org.au/article/2026/former-optus-ceo-says-execs-are-liable-for-bad-ai-agents/hackers-exploit-critical-php-flaws-in-the-wild.html
  2. [new] hackers exploit critical php flaws in the wild: https://ia.acs.org.au/article/2026/hackers-exploit-critical-php-flaws-in-the-wild.html
  3. www.bleepingcomputer.com (amp): https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/amp/
  4. From zdnet.com: https://cert.bournemouth.ac.uk/?p=5514
  5. Exploits in the wild for several PHP-based web apps: https://dshield.org/diary/954
  6. Web Sites Open to Attack From PHP Scripting Holes: https://adtmag.com/articles/2012/05/08/php-scripting-holes.aspx
  7. Multiple vulnerabilities in PHP: https://cybersecurity-help.cz/vdb/SB2023080604
  8. experts warn of mass exploitation of critical php flaw cve 2024 4577: https://securityaffairs.com/175198/hacking/experts-warn-of-mass-exploitation-of-critical-php-flaw-cve-2024-4577.html
  9. [new] Incident & Breach Response, Security Operations (GovInfoSecurity; URL slug "honeypots now recording in the wild php2shell exploits"): https://www.govinfosecurity.com/honeypots-now-recording-in-the-wild-php2shell-exploits-a-33206
  10. CVE 2012 2376: https://exploit-intel.com/vuln/CVE-2012-2376

Tool summary (lead, unread except where a page below was read): it says CVE-2026-109618 and CVE-2026-109619 were "successfully exploited in the wild"; that one report has CISA adding both to its catalogue of known exploited vulnerabilities while BleepingComputer said CISA had not yet done so, and that the tool could not reconcile them; that a researcher's capture-the-flag test ("Steal My Bitcoin CTF proof of concept") reportedly showed exploitation of a standard PHP 8.4.26 install; and, for CVE-2026-115560, PHP's wording "an unusual combination of configuration and application code", "unlikely in practice", with the mitigation session.upload_progress.enabled=0. It adds older flaws (CVE-2024-4577, CVE-2012-2376). The tool's own summary, not a reading of any page.

2. PHP2Shell

  1. php2shell exploit confirmed 35 shells honeypot: https://pasqualepillitteri.it/en/news/27254/php2shell-exploit-confirmed-35-shells-honeypot
  2. PHP2Shell - what it is, how to detect, how to patch: https://pentest-tools.com/research/php2shell-rce
  3. php2shell ataque confirmado 35 shells honeypot (Portuguese): https://pasqualepillitteri.it/pt/news/27261/php2shell-ataque-confirmado-35-shells-honeypot
  4. [new] php2shell: What it is and why you don't need to panic (Hostinger): https://www.hostinger.com/blog/?p=10768
  5. [new] php2shell: What it is and why you don't need to panic (Hostinger): https://www.hostinger.com/blog/what-is-php2shell/
  6. (Hebrew wiki page, title "skip to content"): https://www.hamichlol.org.il/PHP2Shell
  7. [new] What Is PHP2Shell? A Plain-English Guide for Website Owners: https://eseospace.com/blog/what-is-php2shell/

Tool summary (lead, unread except where a page below was read): the two flaws as before; Amazon's honeypots reportedly logged an attempt on 17 October; Adel Karimi reported command execution on three honeypot servers on PHP 8.4.26 with 35 system shells spawned by Apache processes; "Unit 42 linked an attack on a European government agency to php2shell, then retracted the link on Oct. 25 because it couldn't confirm that the attackers gained access through these CVEs"; it found no source confirming a successful break-in on a real production server and says the flaws were not on CISA's catalogue (a statement the sweep files and the dated public account do not support for 26 October: see Triage). The summary credits the version scope (PHP 5.4 through 8.5) to a Hebrew-language encyclopedia entry, presumably the hamichlol.org.il page, which Lighthouse could not read on 30 October (HTTP 403) and did not request today.

3. PHP session upload progress vulnerability CVE-2026-115560

  1. Nuova vulnerabilità PHP CVE-2026-115560, spegni l'upload progress (Italian): https://pasqualepillitteri.it/news/26591/php-cve-2026-115560-spegni-upload-progress
  2. CVE-2026-115560: Another PHP Session-Handler RCE: https://www.getastra.com/blog/?p=49824
  3. PHP discovers new remote code execution flaw but rules out emergency fix: https://www.computing.co.uk/news/2026/security/php-finds-new-remote-code-flaw-no-fix
  4. PHP's nightmare is far from over: new unpatched vulnerability found: https://cybernews.com/security/php2shell-attacks-php-new-vulnerabilities-found/
  5. php cve 2026 115560 turn off session upload progress: https://pasqualepillitteri.it/en/news/26592/php-cve-2026-115560-turn-off-session-upload-progress
  6. PHP Warns of New Code Execution Flaw Days After PHP2Shell Patches: https://securityaffairs.com/?p=201595
  7. PHP CVE-2026-115560 only hits apps that switch serialize_handler to php at runtime: https://lilting.ch/en/articles/php-cve-2026-115560-serialize-handler

No new URLs. Tool summary: informational notice of 23 October 2026; exploit path needs session.serialize_handler set to php_binary or php_serialize, switched to php at runtime before session_start(), with session upload progress enabled; mitigation session.upload_progress.enabled=0; the 21 October releases do not fix it (credited to lilting.ch); as of 23 October no affected version ranges, CVSS score, target release or statement on a shared root cause; one source notes no exploitation reported. The tool says it found no primary php.net advisory.

4. PHP vulnerability websites taken offline

  1. Factbox-Governments, companies take websites offline over PHP flaws: https://www.internazionale.it/ultime-notizie-reuters/2026/10/22/factbox-governments-companies-take-websites-offline-over-php-flaws
  2. Factbox-Websites taken offline over PHP risks: https://www.thestar.com.my/tech/tech-news/2026/10/21/factbox-websites-taken-offline-over-php-risks
  3. Govts, companies take websites offline over PHP flaws: https://www.koreatimes.co.kr/world/20261023/governments-companies-take-websites-offline-over-php-flaws
  4. What's the PHP coding flaw that could pull down 70 percent of the internet? (Al Jazeera): https://www.aljazeera.com/news/2026/10/22/whats-the-php-coding-flaw-that-could-pull-down-70-percent-of-the-internet
  5. theprint.in: https://theprint.in/world/factbox-governments-companies-take-websites-offline-over-php-flaws/3078821/
  6. nltimes.nl: https://nltimes.nl/node/92563
  7. exposure global cyber security warning cloudflare: https://www.lbc.co.uk/tech/exposure-global-cyber-security-warning-cloudflare/
  8. Critical PHP vulnerabilities force government websites offline across Europe: https://jang.com.pk/en/74964-critical-php-vulnerabilities-force-government-websites-offline-across-europe-news
  9. php patch 631972: https://www.silicon.co.uk/cybersecurity/php-patch-631972
  10. Websites pulled offline worldwide as AI finds critical security flaws: https://www.scmp.com/news/world/article/3371694/websites-go-dark-worldwide-ai-exposes-critical-security-flaws
  11. australian businesses pull websites offline over php threat: https://www.smartcompany.com.au/information-technology/australian-businesses-pull-websites-offline-over-php-threat/
  12. Governments and Organizations Take Sites Offline to Patch Web Vulnerability: https://www.pymnts.com/?p=4329059
  13. What is PHP and why did it take government websites offline?: https://arynews.tv/what-is-php-and-why-did-it-take-government-websites-offline
  14. PHP flaws: Bangladesh Bank, land services, six banks' websites remain offline: https://en.prothomalo.com/science-technology/it/b25g8qgplr
  15. [new] Critical PHP flaws put millions of websites at risk as governments pull sites offline (CBS Austin; earlier files hold the KATV copy): https://cbsaustin.com/news/nation-world/critical-php-flaws-put-millions-of-websites-at-risk-as-governments-pull-sites-offline
  16. [new] yle.fi (Finnish broadcaster; title not given): https://yle.fi/a/74-20252600

Tool summary (unread): shutdowns of 21 to 22 October, mostly precautionary (Netherlands, Finland's Valtori, Germany's ITZBund, France's Interior Ministry, Australia, Bangladesh; Wikipedia sections, 4chan, the Internet Archive briefly); the NSA advising disabling sites that cannot be patched at once and the UK NCSC an alert to check systems; Belgium's foreign ministry offline "following reports of cyberattacks exploiting the PHP vulnerabilities" while Belgium's cybersecurity centre "had not recorded any attacks". The summary says its reports date from 21 to 24 October. 4chan is new to the summary.

5. PHP vulnerability AI discovered Gemini OpenAI Wiz

  1. OpenAI says AI found one of the biggest web weaknesses ever: https://www.forbes.com.au/?p=211107
  2. (same title) https://www.forbes.com.au/news/innovation/openai-says-ai-found-one-of-the-biggest-web-weaknesses-ever/
  3. govt websites go dark after ai discovered flaw sparks security scramble 5641112: https://www.monitor.co.ug/uganda/news/world/govt-websites-go-dark-after-ai-discovered-flaw-sparks-security-scramble-5641112
  4. kuwaittimes.com: https://kuwaittimes.com/article/52121/world/websites-go-dark-as-ai-exposes-critical-security-flaws/amp
  5. [new] kuwaittimes.com (same article under a /technology/ path): https://kuwaittimes.com/article/52121/technology/websites-go-dark-as-ai-exposes-critical-security-flaws/amp
  6. thenewstack.io: https://thenewstack.io/?p=22841241
  7. eu.36kr.com: https://eu.36kr.com/en/p/4036210178134916
  8. (title as returned, "Laptop computer engulfed in flames"): https://techcrunch.com/?p=3180197
  9. Gemini and GPT Helped Find PHP Flaws in Up to 70% of Sites: https://fourweekmba.com/ai-gemini-and-gpt-helped-find-php-flaws-in-up-to-70-of-sites/
  10. [new] 20261022 php2shell wiz openai calif (Gigazine): https://gigazine.net/gsc_news/en/20261022-php2shell-wiz-openai-calif/
  11. Ofri Markevitch (LinkedIn profile): https://il.linkedin.com/in/ofri-markevitch
  12. AI tools uncover old PHP flaw causing global service outages: https://www.newsbytesapp.com/news/science/ai-tools-uncover-old-php-flaw-causing-global-service-outages/tldr
  13. www.communicationstoday.co.in: https://www.communicationstoday.co.in/?p=426281
  14. Vulnerability hidden for over 10 years found with AI assistance: https://biz.heraldcorp.com/article/10910643
  15. www.thenewslens.com: https://www.thenewslens.com/article/270684
  16. PHP2Shell: How AI Found a 14-Year-Old Bug in PHP, and Why the Patch Race Is On: https://pub.towardsai.net/php2shell-how-ai-found-a-14-year-old-bug-in-php-and-why-the-patch-race-is-on-70635fdf7b7e
  17. php2shell flaws websites risk: https://www.timesofai.com/news/php2shell-flaws-websites-risk/
  18. Kyunghyang Shinmun (English): https://www.khan.co.kr/en/article/202610221747027
  19. PHP vulnerability: How Google and OpenAI broke the web to save it: https://yourstory.com/ai-story/php-vulnerability-google-openai-web-security
  20. techjacksolutions.com: https://techjacksolutions.com/?p=99319

Tool summary (unread): Calif with OpenAI's GPT-5.6 Sol and Wiz with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, found the flaws independently; Calif reported to PHP on 11 August, Wiz on 24 August; PHP issued emergency patches on 21 October; "OpenAI says the flaws were found by researchers before hackers discovered them". It notes outlet errors ("Kalif", Wiz as "Google's AI platform") and that the model attributions vary. Model names unverified.

6. PHP vulnerability affected products vendors patch

  1. Incident Response (SecurityWeek, amp): https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/amp/
  2. Connect with us (SecurityWeek): https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/
  3. PHP vulnerabilities quickly patched on October 21 (AEB): https://www.aeb.com/en/magazine/articles/php-update.php
  4. NSA recommends PHP patching: https://intelligencecommunitynews.com/?p=45876
  5. Last revised: --: https://vuls.cert.org/confluence/x/4gDDBQ
  6. tns 2018 03 (Tenable, 2018): https://jp.tenable.com/security/tns-2018-03
  7. PHP Arena Affected (2005 CERT vendor note): https://kb.cert.org/vuls/vendor/VU%23459565
  8. PHP Vulnerabilities Response Center (PTC): https://www.ptc.com/en/about/trust-center/advisory-center/active-advisories/php2shell
  9. Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0818
  10. Tenable products affected by PHP < 5.5.21 / 5.4.37 (2015): https://de.tenable.com/security/tns-2015-02
  11. Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-1007
  12. php2shell affected products list: https://securityonline.info/php2shell-affected-products-list/
  13. php patch 631972: https://www.silicon.co.uk/cybersecurity/php-patch-631972
  14. Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0468
  15. Action not permitted: https://cve.circl.lu/vuln/certfr-2024-avi-1007
  16. NSA Says Take PHP Offline if You Cannot Patch, but Some Vendor Fixes Land in 2027: https://www.shashi.co/2026/10/nsa-says-take-php-offline-if-you-cannot.html
  17. Action not permitted (CERT-FR 2025 item): https://db.gcve.eu/vuln/certfr-2025-avi-0209
  18. PHP three vulnerabilities 40524 (Vigilance): https://vigilance.fr/vulnerability/PHP-three-vulnerabilities-40524
  19. Itdaily - PHP2Shell: Major PHP vulnerability actively exploited ahead of patch availability: https://itdaily.com/blogs/software/php2shell-bug-php/
  20. Action not permitted (CERT-FR 2024 item): https://db.gcve.eu/vuln/certfr-2024-avi-0300

No new URLs. Tool summary (unread): fixes on 21 October for PHP 8.2 to 8.5, with one source saying 8.1 and older get no official fix and PHP posting source backports for 7.4, 8.0 and 8.1; Cisco "no products are known to be affected"; Broadcom has not confirmed any Enterprise Security Group product; Check Point Security Management and Log Servers have "a separate, critical flaw" (the tool's wording; the 30 October file's summary read it as PHP-related, which this one does not settle); Duo Access Gateway fix available; Expressway fixed version 15.5.21, no date; PTC has a response page for CVE-2026-109618 and CVE-2026-109619; one list names QNAP (QSA-26-18), Synology (end-of-life PHP 7.3 package) and Sophos (MyUTM portal), with fixed builds pending as of that list's 25 October date; UK NCSC says discovery should cover every PHP installation. Older CERT-FR, Tenable and CERT items are unrelated advisories.

Totals: 80 results, 79 distinct URLs; 10 new, 69 repeated.

New since earlier sweeps

Ten distinct URLs, marked in the results above:

  • Query 1: ia.acs.org.au (two URLs, one article), GovInfoSecurity.
  • Query 2: Hostinger (two URLs, one article), eseospace.com.
  • Query 4: CBS Austin, yle.fi.
  • Query 5: kuwaittimes.com (/technology/ path variant), Gigazine.
  • Queries 3 and 6: none.

Which pages were opened

The four highest-ranked new results, in query order, each of which makes a claim of fact: ia.acs.org.au (query 1, rank 1), ia.acs.org.au (query 1, rank 2, the same title under a shorter path), GovInfoSecurity (query 1, rank 9) and Hostinger (query 2, rank 5; the rank 4 ?p= URL is the same article and was not requested separately). One request each, no retry. Not opened: eseospace.com, CBS Austin, yle.fi, kuwaittimes.com variant, Gigazine, and every repeat. WebFetch returns a small model's answer to a prompt, not the page text, so the quotations below are unverified.

Pages read

A. Information Age (ACS), "hackers exploit critical php flaws in the wild", long path

B. Information Age (ACS), "hackers exploit critical php flaws in the wild", short path

  • URL: https://ia.acs.org.au/article/2026/hackers-exploit-critical-php-flaws-in-the-wild.html
  • Read: 2026-11-02 at about 15:28 UTC, page returned. Page's own date: 28 October 2026 (byline Leonard Bernardone).
  • Claims, each reported by the page:
    • It reports that "security experts have found working exploits" for the two PHP2Shell flaws "being used in the wild", that CISA added both to its known exploited vulnerabilities list, and that exploitation was confirmed "on a Tuesday". It rests, by the page's account, on attacks captured in deliberately set up honeypots, on Adel Karimi's logs (including failed wget commands), and on Amazon detecting attempts about four days before disclosure. It says CISA named no victims.
    • It attributes to Jamieson O'Reilly (Dvuln) the view that the lack of confirmed breaches does not mean none occurred, and to VirusTotal a count of more than five million internet-facing IP addresses running PHP. It describes Karimi as at Perplexity.
    • It reports that the flaws "could let attackers read sensitive data from server memory or, in some cases, run remote code", and names exposure in admin panels, internal tools, APIs, hosting control panels, intranets, network appliances and embedded devices. This describes capability, not an observed compromise of any named product.
    • Primary sources it names: CISA, Amazon's threat intelligence team, VirusTotal, Calif, Wiz, Australia's Signals Directorate. None read.
    • It does not mention CVE-2026-115560 and gives no CVE numbers.
  • Note: "confirmed on a Tuesday" is the page's phrase as relayed by the small model; the page's own date for CISA's listing was not given, and earlier records place the listing on 26 October (a Monday).

C. GovInfoSecurity, honeypots now recording in-the-wild PHP2Shell exploits

D. Hostinger: php2shell, what it is and why you don't need to panic

  • URL: https://www.hostinger.com/blog/what-is-php2shell/
  • Read: 2026-11-02 at about 15:28 UTC, page returned. Page's own date: Tuesday 27 October 2026, last updated 27 October 09:00 UTC, "current as of Oct. 26, 2026". Hostinger is a web host with a commercial interest in the advice it gives.
  • Claims, each reported by the page:
    • It reports that "no successful PHP2Shell break-in has been publicly confirmed" as of 26 October, and that most figures come from firewalls and honeypots, so they count attacks blocked or lured, not breaches.
    • It reports, attributing each to the named party and without a link read here: Amazon (MadPot honeypots) recorded an attempt on 17 October and identified several proof-of-concept exploits on 21 October; Cloudflare saw attempts rise from thousands to millions in a day; Wordfence blocked over 74,000 exploit attempts; watchTowr saw exploitation in its honeypots; Patchstack reports exploitation from hosting partners.
    • It reports that Unit 42 "linked an attack on a European government agency to PHP2Shell, then retracted the link on Oct. 25", and says this shows a reported compromise can fail to hold up. Primary source: Unit 42's own statements, not named by URL, not read.
    • It reports fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, no official patch for PHP 8.1 or older, mod_php as most exposed and PHP-FPM at risk depending on configuration, and that Wiz Research showed remote code execution on Drupal, WordPress and Joomla sites.
    • On CVE-2026-115560 it reports a "third bug" in session upload progress, disclosed in a PHP advisory on 23 October; PHP calls code execution through it unlikely; the 21 October releases do not fix it and the fix is due in the next regular release; interim step session.upload_progress.enabled Off then restart workers; as of 26 October "not in CISA's Known Exploited Vulnerabilities catalog"; and that Hostinger's managed plans were already protected because it switched the feature off on 21 October. Primary source named: the PHP advisory (php.net), not read.

Triage

Leads for the driving session (none read under a protocol):

  • Unit 42's retracted link of an attack on a European government agency to PHP2Shell (retraction on 25 October, per Hostinger and the query 2 tool summary). Named in no earlier sweep file. If true, it is a reported compromise that its own source withdrew; the primary source is Unit 42's statement, to be located and read.
  • Wordfence (74,000 blocked attempts), Cloudflare (attempts rising to millions in a day) and watchTowr (honeypot exploitation): new to the sweep files, from Hostinger only; primary sources are each firm's own posts. These count blocked or lured attempts.
  • Information Age's 28 October report of exploitation resting on honeypots and Karimi's logs, and CISA's catalogue listing: the CISA listing is already in the dated public account, so no new fact there.
  • GovInfoSecurity's piece on honeypots recording exploits (403, unread): probably the Karimi honeypot report already in earlier files; not confirmed.
  • VirusTotal's count of more than five million internet-facing IP addresses running PHP (via Information Age): a figure from a source not read, alongside Censys's earlier count.
  • Items carried over, still unread: PHP's informational advisory for CVE-2026-115560, Red Hat RHSB-2026-013, JPCERT-AT-2026-0033, Amazon (Moses), vendor advisories (QNAP, Synology, Sophos, Check Point, Expressway).

Contradiction to record: the query 2 tool summary says the flaws were not on CISA's catalogue "as of late October"; Information Age (28 October) says CISA added both, and Hostinger's date of currency (26 October) is its own cut-off. The dated public account already records the 26 October listing. The tool summary is the tool's, and not a source.

Not pursued: eseospace.com, CBS Austin, yle.fi, Gigazine, the kuwaittimes.com path variant; the older-flaw results in queries 1 and 6; the CERT-FR, Tenable and CERT items; the Hebrew wiki page.

For the daily log

New, consequential reports (all reported by the named source, none observed by Lighthouse; flagged for review where marked):

  • Hostinger (27 October, current as of 26 October) reports that Unit 42 linked an attack on a European government agency to PHP2Shell and retracted the link on 25 October because it could not confirm the attackers got in through these CVEs; it rests on Unit 42's statements, not read. Flag for review: a claim of compromise, retracted by its own source. Nothing to say in Lighthouse's voice.
  • Hostinger reports, unlinked, Wordfence's 74,000 blocked attempts, Cloudflare's attempts rising to millions in a day and watchTowr's honeypot exploitation; counts of attempts, not of successes. Flag only to locate primary sources.
  • Information Age (28 October) reports exploitation "in the wild" resting on honeypots and Karimi's logs, no victims named by CISA. Restates earlier honeypot claims; no new fact beyond the VirusTotal figure.
  • CVE-2026-115560: nothing new. Hostinger and the tool summaries repeat no version range, no fix before the next regular release, mitigation session.upload_progress.enabled=0, and no exploitation reported (Hostinger, as of 26 October: not in CISA's catalogue). Not flagged.

Waits for the keeper (AGENTS.md): nothing; none of the above is Lighthouse's own claim of harm or compromise.

Limits

One search tool's ranking, on one day, in English: what it returns depends on its index and on wording, and an absence means nothing. Media restate each other; a claim repeated by many outlets is one claim. The tool's summaries are the tool's, not a reading of the pages, and are not evidence. WebFetch answers through a small model, so quotations are unverified. Pages A and C were not read (HTTP 404 and 403). Written by a Claude Sonnet 5.5 sub-agent for the driving session; unreviewed.

From notes/php-media-sweep/2026-11-02T1526Z.md in the repository, last changed 2 November 2026.