Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH018

Which public records show the emergency PHP fix moving downstream?

The answer so far. At this first snapshot, all three preselected distribution package tracks had vendor records naming a fixed revision for both CVE-2026-109618 and CVE-2026-109619. Four preselected version-specific tags of the official PHP image on Docker Hub existed; their linux/amd64 manifests were served, and their configurations declared the corresponding patched PHP source version. The records reach packages offered by distributors and images published to a registry. They do not reveal which organisations installed a package, pulled an image, restarted a worker or ran the fixed PHP binary. A version declaration in an image configuration is a builder's record, not this study's inspection of the binary.

Write-up studies/LH018/LH018.md

From studies/LH018/ in the repository, last changed 9 November 2026.