Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH024

LH024 daily search, 26 October 2026: ranked results as returned

The thirteen frozen queries were sent together at about 06:41 UTC, one each, standard mode, no retry. "..." abbreviates a URL written in full in the 23 October log. [own domain] marks results on the entry's own domain.

  1. php: it-connect.fr/php-failles-...; rapid7.com/blog/post/etr-...; rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now; levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; socprime.com/?p=55067; cyber.gc.ca/en/alerts-advisories/al26-026-...; fastly.com/it/blog/critical-rce-...; pentest-tools.com/network-vulnerability-scanning/php2shell-scanner. No php.net result.
  2. ncsc_uk: cyber.gc.ca/en/alerts-advisories/al26-026-...; rapid7.com/blog/post/etr-...; bitsight.com/blog/critical-vulnerability-alert-...; socprime.com/?p=55033; levelup.gitconnected.com/php2shell-...; socprime.com/?p=55059; fastly.com/es-latam/blog/critical-rce-...; fastly.com/jp/blog/critical-rce-...; sophos.com/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619. No ncsc.gov.uk result.
  3. cisa: fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; socprime.com/?p=55033; bitsight.com/blog/critical-vulnerability-alert-...; kucoin.com/news/flash/php-discloses-...; sophos.com/blog/proof-of-concept-...; levelup.gitconnected.com/php2shell-...; aha.org/h-isac-white-reports/2026-10-21-...; aha.org/system/files/media/file/2026/10/h-isac-...pdf. No cisa.gov result.
  4. cert_eu: socprime.com/?p=55069; secrss.com/articles/94899; lovguiden.dk/en/det-offentlige/cert-eu-cybersikkerhedstjeneste/2026-10-20-...; pentest-tools.com/network-vulnerability-scanning/php2shell-scanner; socprime.com/?p=55063; socprime.com/?p=55061; socprime.com/?p=55059; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-.... No cert.europa.eu result.
  5. cloudflare: fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; rapid7.com/blog/post/etr-...; fastly.com/blog/critical-rce-...; fastly.com/it/blog/critical-rce-...; kucoin.com/news/flash/php-discloses-...; fastly.com/es-latam/blog/critical-rce-...; cyber.gc.ca/fr/alertes-avis/al26-026-...; cyber.gc.ca/en/alerts-advisories/al26-026-.... No cloudflare.com result.
  6. fastly: [own domain] the same ten Fastly URLs as on 23 to 25 October, in the same order (es-latam, English, jp, it, de, fr and es copies of "critical-rce-vulnerabilities-discovered-core-php-...", then es-latam, jp and fr copies of "fastlys-proactive-protection-...").
  7. akamai: socprime.com/?p=55067; rapid7.com/blog/post/etr-...; levelup.gitconnected.com/php2shell-...; kucoin.com/news/flash/php-discloses-...; it-connect.fr/php-failles-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; socprime.com/?p=55061; fastly.com/blog/critical-rce-.... No akamai.com result.
  8. aws: [own domain] aws.amazon.com/security/security-bulletins/2026-143-aws/; rapid7.com/blog/post/etr-...; bitsight.com/blog/critical-vulnerability-alert-...; levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; fieldeffect.com/blog/php-updates-critical-rce-flaws; kucoin.com/news/flash/php-discloses-...; bleepingcomputer.com/news/security/php-warns-admins-...-coming-tomorrow/amp/.
  9. google_cloud: levelup.gitconnected.com/php2shell-...; bitsight.com/blog/critical-vulnerability-alert-...; fastly.com/jp/blog/critical-rce-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; kucoin.com/news/flash/php-discloses-...; it-connect.fr/php-failles-...; fieldeffect.com/blog/php-updates-critical-rce-flaws; aha.org/h-isac-white-reports/2026-10-21-...; aws.amazon.com/security/security-bulletins/2026-143-aws/. No cloud.google.com result.
  10. azure: levelup.gitconnected.com/php2shell-...; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-...; socprime.com/?p=55069; socprime.com/?p=55059; socprime.com/?p=55061; cyber.gc.ca/en/alerts-advisories/al26-026-...; rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now; socprime.com/?p=55063. No azure.microsoft.com result.
  11. register: socprime.com/?p=55033; rapid7.com/blog/post/etr-...; fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; bitsight.com/blog/critical-vulnerability-alert-...; aha.org/h-isac-white-reports/2026-10-21-...; socprime.com/?p=55061; fieldeffect.com/blog/php-updates-critical-rce-flaws. No theregister.com result.
  12. bleepingcomputer: [own domain] the same three BleepingComputer URLs as on 24 and 25 October (the 20 October article, its /amp/ copy, and "php-ships-emergency-patches-for-critical-php2shell-flaws"); then rapid7.com/blog/post/etr-...; socprime.com/?p=55033; levelup.gitconnected.com/php2shell-...; socprime.com/?p=55067; fastly.com/jp/blog/critical-rce-...; bitsight.com/blog/critical-vulnerability-alert-....
  13. ars: bleepingcomputer.com/news/security/php-ships-emergency-patches-...; rapid7.com/blog/post/etr-...; fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; sophos.com/blog/proof-of-concept-...; bitsight.com/blog/critical-vulnerability-alert-...; it-connect.fr/php-failles-...; kucoin.com/news/flash/php-discloses-.... No arstechnica.com result.

No own-domain result is new: the selection equals 25 October's.

From studies/LH024/data/search-2026-10-26.md in the repository, last changed 26 October 2026.