Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH024

LH024: What did a fixed public panel say about the PHP emergency?

Protocol 0.1, fixed 22 October 2026 UTC before this panel's bounded source search. Writer: Codex, GPT-6 Sol in ChatGPT Work Mode. The event and fixed releases, LH018–LH023's publisher and consumer records, and the official-images deployment-glitch issue are known. A 22 October news search before this protocol also exposed relevant PHP, UK NCSC, Cloudflare, Google Cloud and Wiz pages. Their existence is prior knowledge, and this is a purposive panel, not a surprise discovery or random sample. No panel-wide search or classification has yet been made.

Question and units

For the fixed organisations in panel.json, what public record about CVE-2026-109618 or CVE-2026-109619 can a bounded daily reader find, when does each source say it first appeared or changed, and what kind of protective action does its author claim? The unit is an organisation's own page or feed item, not its customers or protected machines. The three media outlets form a separate coverage track; their headlines and publication metadata indicate attention, not an operator's action. Count the two CVEs as one coordinated episode.

The panel fixes ten institutions by role before this study reads their outcomes: upstream PHP; UK NCSC, US CISA and CERT-EU as public agencies; Cloudflare, Fastly and Akamai as network intermediaries; AWS, Google Cloud and Microsoft Azure as large cloud providers. Three technology outlets, The Register, BleepingComputer and Ars Technica, are fixed separately. The roles are purposive. The known Cloudflare, NCSC and Google records are disclosed above. A provider may publish no relevant public page, be missed by this instrument, or revise one; none means it did nothing.

Discovery and capture

On 22 October and then once each UTC day through 28 October, run exactly one site-restricted search per panel entry with the frozen query in panel.json. Keep at most two results per entry that explicitly name a CVE or the two-flaw PHP security release. Record the search time, query, ranked result URL and title, and why a result was included or rejected. On the initial day, a failed search may be retried once and logged. Directly read at most two selected source pages per entry. Retain the URL, HTTP status, retrieval time, canonical URL, page title, author, published and updated times where exposed, a SHA-256 of the fetched bytes, and brief relevant excerpts within quotation limits. For primary institutional records, preserve bounded raw responses when redistribution is appropriate; for media preserve metadata and short excerpts, not a full article copy. If the page refuses a read, retain the failure and use its search metadata with that limit explicit. Never infer a first-publication clock from our first retrieval or treat an updated timestamp as first publication.

Classify an author's public statements as notice, recommended action, claimed patch/rebuild, claimed traffic rule, claimed observation of attempted exploitation, or unclear, allowing more than one. A claim of mitigation is the speaker's claim; no efficacy or deployment is inferred. A citation or explicit reference between two pages is a documented communication link; mere chronological order is not. Retrospective 20–21 October publication fields are labelled source-reported, not a prospective observation. Later snapshots compare changed bytes or fields and retain previous evidence. Every absence is not found in bounded search, source inaccessible, or not yet checked, never no response.

Bounds and stop

At most 16 searches and 30 direct page requests per daily run, 12 MiB of retained primary response bodies, 1 MiB per page, two results per entry, and no paid API. Stop on ceiling or source rate limit and preserve missing cells. No exploit code, external contacts or account actions. Close the baseline when each of the 13 entries has a search result or explicit failure and all selected pages have been attempted; continue scheduled daily observations as separate snapshots. This panel cannot measure all coverage, protective efficacy, attacks, deployments or uptake rates. An interim report after 24 October and synthesis after 28 October require their own review before any public piece.

  • Amendment, 9 November 2026, by the scheduled run's robots sweep (in force from the next read; not retroactive). The keeper decided on 8 November 2026 that Lighthouse obeys robots.txt as its own agent and as whatever runs it (AGENTS.md, Rules that matter; scripts/robots_rules.py, scripts/robots_tokens.json). The gate is scripts/robots_gate.py, which reads each host's robots.txt once per run. scripts/collect.py and collect_daily.py now request each panel URL through scripts/lh_fetch.py's gated urlopen; a URL not allowed is not requested, and its row has no status and the error "NotFetched: not fetched: ..." with the deciding group and rule, a missing reading and never a negative. The User-Agent now carries Lighthouse's token (Mozilla/5.0 (compatible; Lighthouse-research/1.0; +https://lighthouse.harbour.cat); it was Lighthouse-LH024/0.1), and email addresses are withheld from kept bodies; the logged sha256_retained stays that of the bytes received (up to the cap), so an offline replay that compares it with a kept file would differ for a body where an address was withheld. Earlier reads were made without this check, and whether each host's robots.txt allowed them on those days was not checked. The study is finished and no further read is scheduled.

From studies/LH024/brief.md in the repository, last changed 9 November 2026.