Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH028

LH028: What can the first public telemetry establish about this PHP event and AI's role?

Protocol 0.1, fixed 22 October 2026 UTC before direct reading of this panel's selected source pages. Writer: Codex, GPT-6 Sol in ChatGPT Work Mode. Search results seen before this protocol already disclose the following: Amazon says a MadPot honeypot recorded an apparent exploit attempt dated 17 October and further attempts on 21 October; Cloudflare says it deployed WAF protections by default on 21 October; OpenAI says Calif used GPT-5.6 Sol in finding a flaw and Wiz independently found both. These are prior outcomes, not independent findings here. News headlines claim millions of attempts; no primary aggregate has yet been checked. This panel is purposive, not a population sample.

Question, panel and measurements

At this reading, what exact public, first-party statements and quantitative fields are available from three fixed sources: Amazon Threat Intelligence's https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/; Cloudflare's https://blog.cloudflare.com/php-vulnerabilities-waf-protection/; and OpenAI's https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/? The unit is a source statement with its author, public publication/update clock and underlying observation window. Record attempt counts only with the sensor, inclusion rule, denominator, time window and whether the value is a request, alert, unique source or affected host. Do not aggregate across sources or equate attempts with successful exploitation, compromise or prevalence.

For AI, separate documented use in discovery, validation, patching and coordination from inference about an attacker's tooling. A disclosed AI-assisted discovery does not identify the technology used by the actor who sent a network request. Record the exact basis and limits for any attribution claim. Describe the disclosure/release/telemetry sequence using source-reported timestamps and the clock's timezone. Do not resolve a conflict by silently preferring the newest article. Compare the source itself on later reads by byte hash, with a dated revision, not a retrospective first-seen claim.

Capture and bounds

Attempt one direct GET per fixed page using an ordinary user agent on 22 October; retain status, final URL, UTC start and finish, content type, length and SHA-256 with up to 1 MiB per response. Stop a source on 403, placeholder, challenge, 429 or size ceiling and mark its claims unavailable to this direct instrument. For first-party public articles retain bounded raw HTML; no full copied media articles. At most three requests and 3 MiB retained; no crawling, exploit requests, service probes, login or paid feed. An offline replay verifies bytes and metadata. Search snippets and earlier LH024 reads can be leads with their prior knowledge disclosed, but do not replace an inaccessible page's direct body or merge their clocks into this study. Close the initial record after three attempts. Missing data are unknown, not zero.

Overlap and decision

Cloudflare is already in LH024's fixed response panel, so this is an intentionally overlapping deeper telemetry read. AWS is in LH024 by organisation but this selected threat-intelligence article is newly known. OpenAI is a new first-party coordination source. The three are chosen for rich visible outcomes; no frequency of attempts or AI use across the internet can be estimated. A future rapid revisit may compare these exact URLs and add other primary sources only with a dated amendment before reading their bodies. Model spend is unknown; request cost is free. An inaccessible or merely qualitative source leaves its quantitative question inconclusive.

  • Amendment, 9 November 2026, by the scheduled run's robots sweep (in force from the next read; not retroactive). The keeper decided on 8 November 2026 that Lighthouse obeys robots.txt as its own agent and as whatever runs it (AGENTS.md, Rules that matter; scripts/robots_rules.py, scripts/robots_tokens.json). The gate is scripts/robots_gate.py, which reads each host's robots.txt once per run. scripts/collect.py now requests through scripts/lh_fetch.py's gated urlopen (aws.amazon.com, blog.cloudflare.com, openai.com); a URL not allowed is not requested and its row has the error "NotFetched: not fetched: ..." with the deciding group and rule, a missing reading and never a negative. The User-Agent now carries Lighthouse's token (Mozilla/5.0 (compatible; Lighthouse-research/1.0; +https://lighthouse.harbour.cat); it was Mozilla/5.0 (compatible; Lighthouse research observation)), and email addresses are withheld from kept bodies; the logged sha256 stays that of the bytes received, so an offline replay that compares it with a kept file would differ for a body where an address was withheld. Earlier reads were made without this check, and whether each host's robots.txt allowed them on those days was not checked. The study is finished and no further read is scheduled.

From studies/LH028/brief.md in the repository, last changed 9 November 2026.