Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH024

LH024 daily search, 24 October 2026: ranked results as returned

The thirteen frozen queries were sent together at about 06:41 UTC, one each, standard mode, no retry. Lists are transcribed in rank order as returned; "..." abbreviates a URL written in full in the 23 October log. [own domain] marks a result on the entry's domain. As on 23 October, the tool ignored site: for ten of the thirteen.

  1. php: it-connect.fr/php-failles-...; rapid7.com/blog/post/etr-...; bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws; rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now; levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; socprime.com/?p=55067; cyber.gc.ca/en/alerts-advisories/al26-026-...; fastly.com/it/blog/critical-rce-.... No php.net result.
  2. ncsc_uk: cyber.gc.ca/en/alerts-advisories/al26-026-...; rapid7.com/blog/post/etr-...; bitsight.com/blog/critical-vulnerability-alert-...; socprime.com/?p=55033; levelup.gitconnected.com/php2shell-...; socprime.com/?p=55059; aha.org/system/files/media/file/2026/10/h-isac-...pdf; fastly.com/es-latam/blog/critical-rce-...; fastly.com/jp/blog/critical-rce-.... No ncsc.gov.uk result.
  3. cisa: fastly.com/jp/blog/critical-rce-...; en.spaziocrypto.com/security/php-critical-vulnerabilities-cve-2026-109618-cve-2026-109619-patch/; fastly.com/es-latam/blog/critical-rce-...; socprime.com/?p=55069; cyber.gc.ca/en/alerts-advisories/al26-026-...; socprime.com/?p=55063; socprime.com/?p=55055; levelup.gitconnected.com/php2shell-...; socprime.com/?p=55059. No cisa.gov result.
  4. cert_eu: socprime.com/?p=55069; secrss.com/articles/94899; lovguiden.dk/en/det-offentlige/cert-eu-cybersikkerhedstjeneste/2026-10-20-...; pentest-tools.com/network-vulnerability-scanning/php2shell-scanner; socprime.com/?p=55063; socprime.com/?p=55061; socprime.com/?p=55059; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-.... No cert.europa.eu result.
  5. cloudflare: fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; rapid7.com/blog/post/etr-...; fastly.com/blog/critical-rce-...; fastly.com/it/blog/critical-rce-...; kucoin.com/news/flash/php-discloses-...; fastly.com/es-latam/blog/critical-rce-...; cyber.gc.ca/fr/alertes-avis/al26-026-...; cyber.gc.ca/en/alerts-advisories/al26-026-.... No cloudflare.com result.
  6. fastly: [own domain] the same ten Fastly URLs as on 23 October, in the same order (es-latam, English, jp, it, de, fr and es copies of "critical-rce-vulnerabilities-discovered-core-php-...", then es-latam, jp and fr copies of "fastlys-proactive-protection-...").
  7. akamai: socprime.com/?p=55067; rapid7.com/blog/post/etr-...; levelup.gitconnected.com/php2shell-...; kucoin.com/news/flash/php-discloses-...; it-connect.fr/php-failles-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; socprime.com/?p=55061; fastly.com/blog/critical-rce-.... No akamai.com result.
  8. aws: [own domain] aws.amazon.com/security/security-bulletins/2026-143-aws/; rapid7.com/blog/post/etr-...; bitsight.com/blog/critical-vulnerability-alert-...; levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; fieldeffect.com/blog/php-updates-critical-rce-flaws; kucoin.com/news/flash/php-discloses-...; bleepingcomputer.com/news/security/php-warns-admins-...-coming-tomorrow/amp/.
  9. google_cloud: levelup.gitconnected.com/php2shell-...; bitsight.com/blog/critical-vulnerability-alert-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; kucoin.com/news/flash/php-discloses-...; it-connect.fr/php-failles-...; fieldeffect.com/blog/php-updates-critical-rce-flaws; aha.org/h-isac-white-reports/2026-10-21-...; pentest-tools.com/network-vulnerability-scanning/php2shell-scanner. No cloud.google.com result.
  10. azure: levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-...; socprime.com/?p=55069; socprime.com/?p=55059; socprime.com/?p=55061; cyber.gc.ca/en/alerts-advisories/al26-026-...; rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now; socprime.com/?p=55063. No azure.microsoft.com result.
  11. register: socprime.com/?p=55033; rapid7.com/blog/post/etr-...; fastly.com/jp/blog/critical-rce-...; sophos.com/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619; levelup.gitconnected.com/php2shell-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; bitsight.com/blog/critical-vulnerability-alert-...; aha.org/h-isac-white-reports/2026-10-21-...; fieldeffect.com/blog/php-updates-critical-rce-flaws. No theregister.com result.
  12. bleepingcomputer: [own domain] bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow; [own domain] the same article's /amp/ copy; [own domain] bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws; rapid7.com/blog/post/etr-...; socprime.com/?p=55033; levelup.gitconnected.com/php2shell-...; socprime.com/?p=55067; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-....
  13. ars: abcnews4.com/news/nation-world/critical-php-flaws-put-millions-of-websites-at-risk-as-governments-pull-sites-offline; weartv.com/news/nation-world/critical-php-flaws-put-millions-of-websites-at-risk-as-governments-pull-sites-offline; bleepingcomputer.com/news/security/php-ships-emergency-patches-...; levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; socprime.com/?p=55069; rapid7.com/blog/post/etr-...; bitsight.com/blog/critical-vulnerability-alert-...; socprime.com/?p=55055. No arstechnica.com result.

No own-domain result is new since 23 October: today's selection is the 22 October URLs plus the three own-domain results the searches return again.

From studies/LH024/data/search-2026-10-24.md in the repository, last changed 24 October 2026.