Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH024

LH024 daily search, 23 October 2026: ranked results as returned

The thirteen frozen queries of panel.json were sent together at about 17:43 UTC (after 17:42:43 UTC) through the session's web-search tool in its standard mode, one search per entry, no retry. The tool returns a ranked list of titles and URLs and a machine-written summary, and no raw response; each list below is transcribed in rank order as returned, which repairs the deviation LH024's first record disclosed (no ranked list kept). The tool did not honour the site: operator for most queries: for ten of the thirteen, no result was on the entry's own domain, and its summaries say so. A result on another domain is not the entry's record and is not selected; the summaries are not sources.

Results on the entry's own domain are marked [own domain].

  1. php site:php.net CVE-2026-109618 CVE-2026-109619 PHP October 2026: it-connect.fr/php-failles-critiques-rce-cve-2026-109618-cve-2026-109619/; rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/; rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now; levelup.gitconnected.com/php2shell-two-critical-php-flaws-are-being-exploited-heres-how-to-patch-today-add61aa15d10; fastly.com/jp/blog/critical-rce-vulnerabilities-discovered-core-php-cve-2026-109618-cve-2026-109619; socprime.com/?p=55067; cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619; fastly.com/it/blog/critical-rce-vulnerabilities-discovered-core-php-cve-2026-109618-cve-2026-109619; pentest-tools.com/network-vulnerability-scanning/php2shell-scanner. No php.net result.
  2. ncsc_uk site:ncsc.gov.uk ...: cyber.gc.ca/en/alerts-advisories/al26-026-...; levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-cve-2026-109618-and-cve-2026-109619-php2shell; aha.org/h-isac-white-reports/2026-10-21-h-isac-vulnerability-bulletins-tlp-white-two-critical-remote-code-execution-vulnerabilities-php; socprime.com/?p=55069; socprime.com/?p=55055; socprime.com/?p=55061; socprime.com/?p=55063. No ncsc.gov.uk result; the summary says the tool dropped the operator.
  3. cisa site:cisa.gov ...: fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; socprime.com/?p=55033; bitsight.com/blog/critical-vulnerability-alert-...; kucoin.com/news/flash/php-discloses-two-critical-rce-vulnerabilities-patch-expected-tonight; sophos.com/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; levelup.gitconnected.com/php2shell-...; aha.org/h-isac-white-reports/2026-10-21-...; aha.org/system/files/media/file/2026/10/h-isac-vulnerability-bulletins-tlp-white-two-critical-remote-code-execution-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619-10-21-2026.pdf. No cisa.gov result.
  4. cert_eu site:cert.europa.eu ...: enisa.europa.eu/node/19612 ("Joint statement on critical PHP vulnerabilities"); pentest-tools.com/network-vulnerability-scanning/php2shell-scanner; secrss.com/articles/94899; lovguiden.dk/en/det-offentlige/cert-eu-cybersikkerhedstjeneste/2026-10-20-cert-eu-to-kritiske-php-saarbarheder-kan-give-fjernstyret-kodeudfoerelse; socprime.com/?p=55055; socprime.com/?p=55069; socprime.com/?p=55061; ayinedjimi-consultants.fr/cve/cve-2026-109618-php-rce-critique; fastly.com/jp/blog/critical-rce-.... No cert.europa.eu result. The ENISA joint statement names CERT-EU among its authors but is on another domain and another institution's site; it is a lead, not CERT-EU's record.
  5. cloudflare site:cloudflare.com ...: fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; rapid7.com/blog/post/etr-...; fastly.com/blog/critical-rce-vulnerabilities-discovered-core-php-cve-2026-109618-cve-2026-109619; fastly.com/it/blog/critical-rce-...; kucoin.com/news/flash/php-discloses-...; fastly.com/es-latam/blog/critical-rce-...; cyber.gc.ca/fr/alertes-avis/al26-026-vulnerabilites-critiques-touchant-php-cve-2026-109618-cve-2026-109619; cyber.gc.ca/en/alerts-advisories/al26-026-.... No cloudflare.com result.
  6. fastly site:fastly.com ...: [own domain] fastly.com/es-latam/blog/critical-rce-vulnerabilities-discovered-core-php-cve-2026-109618-cve-2026-109619; [own domain] fastly.com/blog/critical-rce-vulnerabilities-discovered-core-php-cve-2026-109618-cve-2026-109619; [own domain] fastly.com/jp/blog/critical-rce-...; [own domain] fastly.com/it/blog/critical-rce-...; [own domain] fastly.com/de/blog/critical-rce-...; [own domain] fastly.com/fr/blog/critical-rce-...; [own domain] fastly.com/es/blog/critical-rce-...; [own domain] fastly.com/es-latam/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618; [own domain] fastly.com/jp/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618; [own domain] fastly.com/fr/blog/fastlys-proactive-protection-critical-php-rce-cve-2026-109618.
  7. akamai site:akamai.com ...: socprime.com/?p=55067; rapid7.com/blog/post/etr-...; levelup.gitconnected.com/php2shell-...; kucoin.com/news/flash/php-discloses-...; it-connect.fr/php-failles-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; socprime.com/?p=55061; fastly.com/blog/critical-rce-.... No akamai.com result.
  8. aws site:aws.amazon.com ...: [own domain] aws.amazon.com/security/security-bulletins/2026-143-aws/; rapid7.com/blog/post/etr-...; socprime.com/?p=55055; fastly.com/es/blog/critical-rce-...; fastly.com/es-latam/blog/critical-rce-...; socprime.com/?p=55061; socprime.com/?p=55069; fastly.com/jp/blog/critical-rce-...; socprime.com/?p=55067.
  9. google_cloud site:cloud.google.com ...: levelup.gitconnected.com/php2shell-...; bitsight.com/blog/critical-vulnerability-alert-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; kucoin.com/news/flash/php-discloses-...; it-connect.fr/php-failles-...; fieldeffect.com/blog/php-updates-critical-rce-flaws; aha.org/h-isac-white-reports/2026-10-21-...; pentest-tools.com/network-vulnerability-scanning/php2shell-scanner. No cloud.google.com result.
  10. azure site:azure.microsoft.com ...: levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-...; socprime.com/?p=55069; socprime.com/?p=55059; socprime.com/?p=55061; cyber.gc.ca/en/alerts-advisories/al26-026-...; rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now; socprime.com/?p=55063. No azure.microsoft.com result.
  11. register site:theregister.com ...: socprime.com/?p=55033; rapid7.com/blog/post/etr-...; fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; bitsight.com/blog/critical-vulnerability-alert-...; aha.org/h-isac-white-reports/2026-10-21-...; socprime.com/?p=55061; fieldeffect.com/blog/php-updates-critical-rce-flaws. No theregister.com result.
  12. bleepingcomputer site:bleepingcomputer.com ...: [own domain] bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow; [own domain] bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/amp/; [own domain] bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws; rapid7.com/blog/post/etr-...; socprime.com/?p=55033; levelup.gitconnected.com/php2shell-...; socprime.com/?p=55067; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-....
  13. ars site:arstechnica.com ...: bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws; rapid7.com/blog/post/etr-...; fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; sophos.com/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; bitsight.com/blog/critical-vulnerability-alert-...; it-connect.fr/php-failles-...; kucoin.com/news/flash/php-discloses-.... No arstechnica.com result.

URLs are given without the https://www. prefix where the tool returned one; "..." abbreviates a URL already written in full earlier in this file.

From studies/LH024/data/search-2026-10-23.md in the repository, last changed 23 October 2026.