Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH024

LH024 daily search, 27 October 2026: ranked results as returned

The thirteen frozen queries were sent together at about 06:37 UTC, one each, standard mode, no retry. "..." abbreviates a URL written in full in the 23 October log or later logs. [own domain] marks results on the entry's own domain. The result sets moved more today than on any day since 23 October: several new third-party pages appear (computingforgeeks.com, letsdatascience.com, techcareer.net, a LinkedIn post, digitalpolicyalert.org, windowsreport.com, wiz.io's CVE pages, unit42.paloaltonetworks.com, avepoint.com, magecomp.com, aiweekly.co, app.dealroom.co, a Linode status mirror on pulsetic.com, and vulmon.com's page for CVE-2026-115560).

  1. php: computingforgeeks.com/?p=176644; it-connect.fr/php-failles-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; computingforgeeks.com/php2shell-cve-2026-109618-check-patch/; levelup.gitconnected.com/php2shell-...; letsdatascience.com/news/openai-model-helps-uncover-critical-php-flaws-forcing-emerge-271fce13; fastly.com/jp/blog/critical-rce-...; socprime.com/?p=55067; cyber.gc.ca/en/alerts-advisories/al26-026-.... No php.net result.
  2. ncsc_uk: digitalpolicyalert.org/change/22109-guidance-on-critical-hypertext-pre-processor-vulnerabilities; cyber.gc.ca/en/alerts-advisories/al26-026-...; digitalpolicyalert.org/event/44881-national-cyber-security-centre-issued-guidance-on-critical-hypertext-pre-processor-vulnerabilities; cyber.gc.ca/fr/alertes-avis/al26-026-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; levelup.gitconnected.com/php2shell-...; bitsight.com/blog/critical-vulnerability-alert-...; socprime.com/?p=55059. No ncsc.gov.uk result.
  3. cisa: techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; bitsight.com/blog/critical-vulnerability-alert-...; letsdatascience.com/news/openai-model-helps-...; kucoin.com/news/flash/php-discloses-...; levelup.gitconnected.com/php2shell-...; aha.org/h-isac-white-reports/2026-10-21-...; aha.org/system/files/media/file/2026/10/h-isac-...pdf. No cisa.gov result.
  4. cert_eu: socprime.com/?p=55069; techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; secrss.com/articles/94899; lovguiden.dk/en/det-offentlige/cert-eu-cybersikkerhedstjeneste/2026-10-20-...; socprime.com/?p=55067; pentest-tools.com/network-vulnerability-scanning/php2shell-scanner; lovguiden.dk/en/det-offentlige/eu-agenturet-for-cybersikkerhed/2026-10-21-kritiske-php-saarbarheder-enisa-opfordrer-til-hurtig-opdatering; socprime.com/?p=55061; fastly.com/jp/blog/critical-rce-.... No cert.europa.eu result.
  5. cloudflare: app.dealroom.co/news/note/php-ships-emergency-patches-for-critical-php2shell-flaws-enabling-remote-code-execution; fastly.com/jp/blog/critical-rce-...; levelup.gitconnected.com/php2shell-...; letsdatascience.com/news/openai-model-helps-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; fastly.com/it/blog/critical-rce-...; fastly.com/es-latam/blog/critical-rce-...; cyber.gc.ca/fr/alertes-avis/al26-026-.... No cloudflare.com result.
  6. fastly: [own domain] fastly.com/es-latam, English, jp, it, de, fr and es copies of "critical-rce-vulnerabilities-discovered-core-php-..."; [own domain] fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-CVE-2026-109618-and-CVE-2026-109619/; [own domain] jp and fr copies of "fastlys-proactive-protection-...". All already selected or copies of selected pages.
  7. akamai: [own domain] akamai.com/blog/security-research/critical-remote-code-execution-vulnerabilities-php-core (already selected, carried from 22 October); pulsetic.com/status/linode/incidents/151561/; letsdatascience.com/news/openai-model-helps-...; levelup.gitconnected.com/php2shell-...; kucoin.com/news/flash/php-discloses-...; fastly.com/jp/blog/critical-rce-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; cyber.gc.ca/fr/alertes-avis/al26-026-....
  8. aws: [own domain] aws.amazon.com/security/security-bulletins/2026-143-aws/; aiweekly.co/alerts/aws-attackers-exploited-php2shell-cve-2026-1096189-in-the-wild-four-days-before; socprime.com/?p=55067; magecomp.com/blog/two-critical-php-security-vulnerabilities/; levelup.gitconnected.com/php2shell-...; letsdatascience.com/news/openai-model-helps-...; fastly.com/jp/blog/critical-rce-...; techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; cyber.gc.ca/en/alerts-advisories/al26-026-....
  9. google_cloud: [own domain] docs.cloud.google.com/support/bulletins?authuser=26 (the selected bulletins page with a query parameter); wiz.io/fr-fr/vulnerability-database/cve/cve-2026-109619; wiz.io/fr-fr/vulnerability-database/cve/cve-2026-109618; windowsreport.com/google-cloud-warns-of-critical-php-flaws-affecting-millions-of-websites/; windowsreport.com/?p=1513035; windowsreport.com/google-cloud-warns-of-critical-php-vulnerabilities-affecting-millions-of-websites/; levelup.gitconnected.com/php2shell-...; cyber.gc.ca/fr/alertes-avis/al26-026-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; letsdatascience.com/news/openai-model-helps-....
  10. azure: techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; levelup.gitconnected.com/php2shell-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; letsdatascience.com/news/openai-model-helps-...; unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619.md; socprime.com/?p=55061; cyber.gc.ca/en/alerts-advisories/al26-026-...; avepoint.com/company/security-notice-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619; fieldeffect.com/blog/php-updates-critical-rce-flaws. No azure.microsoft.com result.
  11. register: levelup.gitconnected.com/php2shell-...; letsdatascience.com/news/openai-model-helps-...; bitsight.com/blog/critical-vulnerability-alert-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; aha.org/h-isac-white-reports/2026-10-21-...; techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619.md; fieldeffect.com/blog/php-updates-critical-rce-flaws; cyber.gc.ca/fr/alertes-avis/al26-026-.... No theregister.com result.
  12. bleepingcomputer: [own domain] the 20 October article and its /amp/ copy (both already selected); vulmon.com/vulnerabilitydetails?qid=CVE-2026-115560; levelup.gitconnected.com/php2shell-...; socprime.com/?p=55067; cyber.gc.ca/fr/alertes-avis/al26-026-...; techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; bitsight.com/blog/critical-vulnerability-alert-...; letsdatascience.com/news/openai-model-helps-.... The "php-ships-emergency-patches-..." article, selected since 24 October, is not in today's list; it stays selected (carried). The tool's summary mentions a BleepingComputer article of 23 October titled "PHP shares mitigation for new RCE vulnerability with no patch", whose URL was not among the results; not selected, a lead only.
  13. ars: techcareer.net/en/blog/php-de-kritik-guvenlik-alarmi-...; bg.linkedin.com/in/emil-georgiev-453b8a1b7; levelup.gitconnected.com/php2shell-...; cyber.gc.ca/en/alerts-advisories/al26-026-...; letsdatascience.com/news/openai-model-helps-...; bitsight.com/blog/critical-vulnerability-alert-...; unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619.md; cyber.gc.ca/fr/alertes-avis/al26-026-...; it-connect.fr/php-failles-.... No arstechnica.com result.

No own-domain URL outside the current selection: the selection equals 26 October's.

From studies/LH024/data/search-2026-10-27.md in the repository, last changed 27 October 2026.