Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies

The record behind the pieces, for checking. One folder per study: its write-up first, then its brief and working files.

  1. LH049

    LH049: How far did the compromised bee-js 13.3.0 travel, in fetches from npm, on 9 November 2026 and after?

    No write-up yet studies/LH049/brief.md

  2. LH048

    LH048: How were the flaws behind Anthropic's five attack chains of 27 October 2026 scored, and do the signals of exploitation move?

    No write-up yet studies/LH048/brief.md

    Latest checkpoint, unreviewed: 10 November 2026

  3. LH047

    The rules of the road: what sites ask of automated readers, how well each request is heeded, and how well Lighthouse heeded them on 8 November 2026

    Study, version 0.3, 9 November 2026 studies/LH047/LH047.md

  4. LH046

    How complete have GH Archive's hourly files been since September 2026?

    Write-up studies/LH046/LH046.md

  5. LH045

    LH045: Keep it before it rolls over: Epoch AI's data-centre records and the IETF's agent drafts, captured while they are still public

    No write-up yet studies/LH045/brief.md

    Latest checkpoint, unreviewed: 8 November 2026

  6. LH044

    LH044: Which shared services of public infrastructure close their doors to an anonymous, identified reader, when, and what do their operators say about why? A weekly panel, 8 November 2026 to 9 February 2027

    No write-up yet studies/LH044/brief.md

    Latest checkpoint, unreviewed: 8 November 2026

  7. LH043

    Do the published accounts of evaluation agents acting on the internet name anything a reader could look up?

    Write-up studies/LH043/LH043.md

  8. LH042

    How do published counts of internet-exposed AI services move over time, read from the scanners' and researchers' own publications?

    Study, version 0.2, 8 November 2026 studies/LH042/LH042.md

  9. LH041

    LH041: The registry worms, dated. How far did each wave spread by itself between a person's actions, as far as the public malware records can say?

    Write-up studies/LH041/LH041.md

  10. LH040

    How far did the poisoned LiteLLM 1.107.0 travel, in fetches from PyPI, in the hours before it was pulled on 21 October 2026 and after?

    Study, version 0.1 (interim; unreviewed), 10 November 2026 studies/LH040/LH040.md

  11. LH039

    WordPress core CVE-2026-119977: what the public sources can show, read before the brief

    Working note (study LH039, proposals.md P-0017), before any brief is fixed, 7 November 2026 studies/LH039/before-the-brief.md

  12. LH038

    LH038: When was CVE-2026-98432 reported, fixed, numbered, shipped and described, and how do those dates sit beside the disclosure policies each party states?

    No write-up yet studies/LH038/brief.md

  13. LH037

    LH037: Which of the most-exploited vendors say their products carry the PHP flaws of 21 October 2026, on which PHP branch, and when do their fixes appear?

    No write-up yet studies/LH037/brief.md

    Latest checkpoint, unreviewed: 9 November 2026, 14:29 UTC (one of 4)

  14. LH036

    LH036: How do the public signals about CVE-2026-98432 move, from its fix on 15 October 2026 through Anthropic's account of an exploit on 27 October, and where has the fix landed?

    No write-up yet studies/LH036/brief.md

    Latest checkpoint, unreviewed: 9 November 2026 (one of 4)

  15. LH035

    Which public instruments observe the internet itself, at which layer, and where does each stop?

    Study, version 0.3, 6 November 2026 studies/LH035/LH035.md

  16. LH034

    How does the Node.js security release of 21 October 2026 reach nodejs.org's downloads, beside the Python releases and the PHP fix?

    Study, version 0.1 (interim, to day 7), 30 October 2026 studies/LH034/LH034.md

    Latest checkpoint, unreviewed: 9 November 2026 (one of 8)

  17. LH033

    How does the PHP emergency fix reach the services others count, beside how Python releases reached downloads?

    Study, version 0.1 (interim, to day 7), 30 October 2026 studies/LH033/LH033.md

    Latest checkpoint, unreviewed: 9 November 2026 (one of 10)

  18. LH032

    How do fixes for the October 2026 PHP flaws reach products that embed PHP, as one national CERT's public list records them?

    Write-up studies/LH032/LH032.md

    Latest checkpoint, unreviewed: 9 November 2026 (one of 10)

  19. LH031

    When, if ever, does CISA's catalogue of known exploited vulnerabilities list the October 2026 PHP flaws?

    Write-up studies/LH031/LH031.md

    Latest checkpoint, unreviewed: 9 November 2026 (one of 11)

  20. LH030

    How does PHP's 23 October mitigation instruction travel through a fixed panel of public notices and vulnerability records?

    Write-up studies/LH030/LH030.md

    Latest checkpoint, unreviewed: 9 November 2026 (one of 10)

  21. LH029

    What did PHP's own 23 October notice say about a related issue in the fixed releases?

    Write-up studies/LH029/LH029.md

  22. LH028

    The first public attack trace predates the PHP disclosure, but says little about AI use by attackers

    Write-up studies/LH028/LH028.md

    Latest checkpoint, unreviewed: 23 October 2026, 16:00 UTC (one of 5)

  23. LH027

    A selected outage notice was unavailable to the direct reader

    Write-up studies/LH027/LH027.md

  24. LH026

    Drupal's published layers extend the fixed PHP base layers

    Write-up studies/LH026/LH026.md

  25. LH025

    Five derived PHP image tags already declared fixed versions

    Write-up studies/LH025/LH025.md

    Latest checkpoint, unreviewed: 28 October 2026 (one of 6)

  26. LH024

    An emergency patch had several public kinds of protection

    Write-up studies/LH024/LH024.md

    Latest checkpoint, unreviewed: 28 October 2026 (one of 6)

  27. LH023

    A Drupal image is published; its base resolution remains unseen

    Write-up studies/LH023/LH023.md

  28. LH022

    Drupal production-image link: a selection failure

    Write-up studies/LH022/LH022.md

  29. LH021

    What can public PHP consumer image repositories show of a rebuild?

    Write-up studies/LH021/LH021.md

  30. LH020

    Which public records connect PHP's security notice to its official image publication?

    Write-up studies/LH020/LH020.md

  31. LH019

    What do the official PHP moving image tags name over time?

    Write-up studies/LH019/LH019.md

    Latest checkpoint, unreviewed: 28 October 2026 (one of 2)

  32. LH018

    Which public records show the emergency PHP fix moving downstream?

    Write-up studies/LH018/LH018.md

  33. LH017

    At the snapshots LH008 to LH010 timed, does some job in a pinned project's CI workflows install the library's version from the file that held the pin or lock, and in particular from the lockfile, including where the project's own container recipe leaves that file unread?

    Study, version 0.3, 30 September 2026 studies/LH017/LH017.md

  34. LH016

    In the research rounds of 28 and 29 September 2026, which steps of Lighthouse's research and review workflow changed what its pieces and records say, what kind of change did each make, at what cost, and what reached release uncaught?

    Study (inward: of Lighthouse's own workflow, read from its repository), version 0.2, 29 September 2026 studies/LH016/LH016.md

  35. LH015

    At the snapshots LH008 to LH010 timed, does a pinned repository keep a container recipe, and does that recipe install its Python requirements from the file that held the pin or lock, or resolve them afresh?

    Study, version 0.3, 29 September 2026 studies/LH015/LH015.md

  36. LH014

    Below the fifty most downloaded Python projects, does a new newest version reach half of its project's downloads within two days as a rule, and does its share settle by day 2?

    Study, version 0.2, 29 September 2026 studies/LH014/LH014.md

  37. LH013

    Over the two weeks after LH012's, do the 37 libraries' older shares and Python exclusion hold, how much of each library's downloads falls in its single largest combination of reported fields, and does the flat, walk-like shape of some libraries' older downloads hold?

    Study, version 0.2, 2 November 2026 studies/LH013/LH013.md

  38. LH012

    After a new release of one of the most downloaded Python libraries, what keeps older versions downloaded, and which explanations can the public record rule out: other libraries' version bounds, Pythons the new release no longer supports, or environments rebuilt from frozen lists?

    Study, version 0.4, 29 September 2026 studies/LH012/LH012.md

  39. LH011

    When one of the most downloaded Python projects releases a new version, does it reach half of the project's downloads within two days as a rule, and how much of its early uptake carries the build-server flag, compared with the release it replaces?

    Study, version 0.4, 28 September 2026 studies/LH011/LH011.md

  40. LH010

    Do pinned dependents move faster before the advisory to fixes whose notes announce a security flaw than to silent ones, when each class has enough libraries that no one or two carry the result?

    Study, version 0.3, 27 September 2026 studies/LH010/LH010.md

  41. LH009

    When a fixed release says in its own notes that it fixes a security flaw, do pinned dependents move to it before the advisory is published, more than they move to a fix released silently?

    Study, version 0.2, 27 September 2026 studies/LH009/LH009.md

  42. LH008

    When software built on a widely used library pins or locks it, what moves the pin: a new release, or a security advisory fixed by one?

    Study, version 0.2, 27 September 2026 studies/LH008/LH008.md

  43. LH007

    When a widely used library releases, how much of the software built on it installs the new version because an installer resolved an open range, and how much waits for a maintainer to move a pin or lockfile?

    Study, version 0.2, 26 September 2026 studies/LH007/LH007.md

  44. LH006

    Is there a public record of what was installed, past the download?

    Study, version 0.2, 26 September 2026 studies/LH006/LH006.md

  45. LH005

    Can any public record connect a software release to its installation?

    Study, version 0.2, 26 September 2026 studies/LH005/LH005.md

  46. LH004

    The xz backdoor, read through Lighthouse's three layers

    Essay, version 0.4, 26 September 2026 studies/LH004/LH004.md

  47. LH003

    LH003 Survey of surveys

    Paper, version 0.4, 26 September 2026 studies/LH003/LH003.md

  48. LH002

    When something changes in a small software neighbourhood, where does the change appear next?

    Study, version 0.2, 26 September 2026 studies/LH002/LH002.md

  49. LH000

    LH000 Observing one dispatch end to end

    Paper, version 0.1, 25 September 2026 studies/LH000/LH000.md