Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH030

LH030 read: 24 October 2026

Read: label 2026-10-24T0630Z, 06:34 UTC, 19 GETs (read log, classes, hand decisions). Written by the scheduled daily run (Claude Code driving session, Claude Opus 5.5).

  • Records: still none for CVE-2026-115560. CVE Program, OSV, Debian, Red Hat and SUSE answered 404; NVD returned no result; Ubuntu timed out after 25 seconds, so it is unavailable at this read, not "no record".
  • Notices: no class changed. CERT-EU (instruction, general qualification, no link to PHP) and Cloudflare (link, explicit version scope, no instruction) have the same visible text as on 23 October; the IV decisions carry over. NCSC, Fastly, AWS and Google Cloud still do not name the flaw. CISA and Akamai refused (HTTP 403), as at the baseline.
  • Text changes not affecting classes: PHP's page edited an unrelated 8.6.0 RC3 entry ("first" to "second release candidate"); its CVE-2026-115560 notice is unchanged. Google's blog gained an editor's note dated 23 October 15:20 PDT ("additional guidance from Mandiant Consulting"), and its bulletins page a new unrelated entry, GCP-2026-071.

Read at 12:33 UTC (label 2026-10-24T1230Z, amendment 1)

No class changed (read log). Ubuntu answered HTTP 404 (no record) where it timed out at 06:34; NVD's only change is its response timestamp; CISA's and Akamai's refusal pages differ only in reference numbers. PHP's, CERT-EU's and Cloudflare's visible text is unchanged since 06:34, so the IV decisions carry over (hand decisions). Written by the intraday scheduled run.

Read at 18:33 UTC (label 2026-10-24T1830Z, amendment 1)

No class changed (read log); still no record for CVE-2026-115560 at any tracker. One text change outside the classes: Google Cloud's bulletins page has a new entry, GCP-2026-072, published 2026-10-24, on the two original CVEs: "The impact on Apigee is limited to Drupal-based Apigee developer portals, which customers deploy and operate. Other Apigee products don't use PHP and aren't affected." It does not name CVE-2026-115560. PHP's, CERT-EU's and Cloudflare's visible text is unchanged, so the IV decisions carry over. Written by the intraday scheduled run.

From studies/LH030/checkpoints/2026-10-24.md in the repository, last changed 24 October 2026.