LH030 reads: 2 November 2026

Read at 15:26 UTC (label 2026-11-02T1526Z)

First Monday and Thursday read after the daily reads ended. No class changed against the 13:04 read of 30 October (read log). All seven trackers still hold no record for CVE-2026-115560 (CVE Program, OSV, Debian, Ubuntu, Red Hat and SUSE HTTP 404; NVD HTTP 200 with a 146-byte body, classed no record as before). CISA's alert page and Akamai refused (HTTP 403). PHP's news page is byte-identical to the 30 October 13:04 read; Cloudflare's, CERT-EU's, Fastly's first URL and Google Cloud's two pages differ in bytes from that read, but the classifier's I, II, III and V and the IV snippets are the same for every entry, so the IV decisions are carried over (hand_iv.json). Unchanged state: PHP carries I, II and III; CERT-EU and Cloudflare name the issue (CERT-EU with the instruction); Cloudflare links to PHP and states an explicit scope; NCSC UK, Fastly, AWS and Google Cloud do not name it.

Stop condition, as of this read: not met. The brief stops at the first scheduled read at least two days after PHP's news page shows its next regular bugfix release for the 8.x branches. PHP's news page (this read, php_0.raw) lists no 8.x release after 8.5.12, 8.4.27, 8.3.36 and 8.2.35 of 21 October (the emergency fixes) and the Windows rebuilds of 26 October (8.5.12-1 and so on); its latest items are the 23 October notice and PHP 8.6.0 RC4. A separate check on 2 November at about 15:27 UTC of php.net's releases JSON (/releases/index.php?json&version=8) lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 dated 21 October and the next entries 8.5.11 and 8.4.26 of 24 September; its ChangeLog-8 page lists 8.5.12 with the date 22 October. No regular 8.x release since 23 October was found, so no read yet qualifies. The brief's last date is 30 November 2026. That separate check was made by direct GET without retention and is not a retained read.