Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH030

How does PHP's 23 October mitigation instruction travel through a fixed panel of public notices and vulnerability records?

In short. On 23 October PHP told people how to protect themselves from a related third flaw (CVE-2026-115560) until a fix arrives. Did that advice spread? We follow it through 15 fixed public sources, seven vulnerability databases and eight security bodies' notices, read twice a week. In the first week only CERT-EU carried the advice and no database opened an entry; on 5 November SUSE became the first database to open one (unreviewed, from that day's checkpoint). The watch ends at the first read two days after PHP's next regular release, or on 30 November.

Latest read, 9 November 2026 (unreviewed working note): Monday's read of how PHP's 23 October instruction about the newer flaw travels. Nothing changed: SUSE still holds the only tracker record for CVE-2026-115560, unchanged since 4 November, and no other tracker or notice in the panel changed its classes. PHP has made no regular 8.x release since 21 October, so the study goes on; PHP's own page now says the first 8.6.0 release is planned for 19 November. Read the note

Write-up studies/LH030/LH030.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH030/ in the repository, last changed 9 November 2026.