Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH024

LH024 daily checkpoint: 23 October 2026

Search: the thirteen frozen queries, one each, sent at about 17:43 UTC; ranked results as returned. Reads: 20 direct GETs, 17:44:23 to 17:44:25 UTC, with collect_daily.py, a dated copy of the first day's collector; read log and selection. Written by a Claude Code driving session (Claude Opus 5.5).

How the day's selection was made. The brief asks for one search per entry and at most two selected results per entry; the record's Next asks for daily copies of the first day's exact URLs. Both were done: the 17 URLs of 22 October were read again as carried reads, and the day's searches added three own-domain results that name the CVEs (Fastly's "Critical RCE Vulnerabilities Discovered in Core PHP" post, AWS security bulletin 2026-143-AWS, and BleepingComputer's "PHP ships emergency patches for critical PHP2Shell flaws", media, metadata only). This rule was set after the day's search results were seen; it adds what the searches found and drops nothing. The search tool did not honour site: for ten of the thirteen queries, so "not found in bounded search" today mostly measures the tool.

What changed since 22 October

  • Access. AWS's two Amazon Linux advisories and Google Cloud's two pages, 195-byte placeholders on 22 October, were read in full (Google's bulletins page reached the 512 KiB ceiling, so its hash is of a prefix). CISA still refused (HTTP 403). Akamai answered HTTP 200 to this collector at 17:44 UTC; LH030's collector, with a different user agent, was refused at 17:15 UTC, so access here depends on the reader as well as the day.
  • New first-party record, AWS. Security bulletin 2026-143-AWS, "PHP web runtimes (CVE-2026-109618 and CVE-2026-109619)", gives a publication date of 21 October 14:30 PDT and a last update of 22 October 14:00 PDT. It says AWS services are not affected; that updated Elastic Beanstalk platform versions for PHP 8.2 to 8.5 are released, applied automatically to customers with managed platform updates in their next maintenance window; that updated Lightsail blueprints are available but running Lightsail instances cannot be updated in place; and that upgrading is the only complete fix. Classes: notice, recommended action, claimed patch or rebuild. These are AWS's claims; no instance or platform was observed.
  • Amazon Linux advisories, now readable: ALAS2023-2026-3304 (php8.5) and ALAS2023-2026-3302 (php8.3), each naming both CVEs, with an updated date of 22 October. Class: claimed patch.
  • Google Cloud, now readable, classed later the same evening from the retained bytes (google_cloud_0.raw, google_cloud_1.raw; no new request).
    • Blog "Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619", dated 21 October, by Google Cloud's CISO and the head of Gemini security at Google DeepMind. Its editor's note records updates on 21 October and on 22 October at 9:25 and 16:07 PDT. Classes: notice, recommended action (upgrade and redeploy; App Engine standard runtimes "patched automatically"; Cloud Run with automatic base-image updates), claimed traffic rule (Cloud Armor managed rules applied automatically for customers with them active).
    • The same blog's AI-role claim: "Wiz used a mix of models to identify and help remediate these vulnerabilities. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch." This is Google's claim about its own model in defensive work, beside OpenAI's account (LH028) that a Calif researcher used one of its models and that Wiz independently found both flaws. The two accounts are not reconciled here; neither concerns an attacker's tools. Not yet in the public account; a candidate for its next dated revision, after review.
    • Bulletin GCP-2026-070, published 2026-10-21: names both CVEs, says Google Cloud itself is not vulnerable, gives affected versions as "All PHP versions between 5.4 and 8.5" and the fixed releases, and advises redeploying with updated dependencies. Classes: notice, recommended action, claimed patch (automatic for some products). Its page reached the 512 KiB ceiling; the entry is within the retained prefix.
  • Revisions seen in fields: Cloudflare's article:modified_time moved from 21 October 19:12 UTC to 23 October 15:09 UTC (LH028 records the content). Every other page's bytes changed, which alone is not a claim revision.
  • The related flaw. PHP's page, CERT-EU's advisory and Cloudflare's page name CVE-2026-115560; no other page read today does. LH030 follows that question on its own frame and counts; nothing here is counted twice.

The four inaccessible entries of 22 October are now three readable and one refused; that changes what this panel can see, not what the institutions did. No exploit was run, no site probed and nobody contacted.

From studies/LH024/checkpoints/2026-10-23.md in the repository, last changed 23 October 2026.