Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH030

LH030 reads: 5 November 2026

Read at 14:14 UTC (label 2026-11-05T1414Z)

Thursday read. One class changed against the 15:26 read of 2 November: SUSE now holds a record for CVE-2026-115560, the first of the seven trackers to do so (read log, classes). Its page (HTTP 200; on 2 November HTTP 404) gives the overall state "Analysis", rates the issue "moderate severity", links SUSE Bugzilla entry 1289303 (state NEW), cross-references no SUSE security announcement, lists every php7 and php8 source package in its product table with the state "Analysis", carries an empty Description field, and dates itself "CVE page created: Wed Nov 4 14:54:44 2026" and "last modified: Wed Nov 4 17:54:00 2026" (SUSE's clock; the page names no time zone). Classes: I yes (names the issue), II no (no instruction), III no, IV none, V links only to MITRE and SUSE's own pages. It names no fixed package and no fixed PHP version. This dates SUSE's tracking of the issue, not any fix reaching SUSE's users.

The other six trackers hold no record: CVE Program, OSV, Debian and Red Hat HTTP 404; NVD HTTP 200 with zero results, classed no record as before; Ubuntu answered HTTP 503 this time (404 on 2 November), classed unavailable, so Ubuntu's state at this read is unknown, not no record. CISA's alert page and Akamai refused (HTTP 403), as before.

PHP's news page differs in bytes from the 2 November read only in site navigation and footer (a sidebar link to the 26 October Windows builds item is gone); no entry was added or changed. Cloudflare's page adds an author name; CERT-EU's differs in bytes but not in extracted text. Their I, II, III and V classes and IV snippets are unchanged, so the IV decisions are carried over (hand_iv.json). Unchanged state: PHP carries I, II and III; CERT-EU and Cloudflare name the issue (CERT-EU with the instruction); Cloudflare links to PHP and states an explicit scope; NCSC UK, Fastly, AWS and Google Cloud do not name it.

Stop condition, as of this read: not met. PHP's news page lists no 8.x release after the 21 October emergency fixes and the 26 October Windows rebuilds. A separate check at 14:17 UTC of php.net's releases JSON (/releases/index.php?json&version=8) lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 dated 21 October, then 8.5.11 and 8.4.26 of 24 September; that check was a direct GET without retention, not a retained read. The brief's last date is 30 November 2026.

Whether SUSE's record changes any public account: the dated PHP account says nothing about trackers' records of CVE-2026-115560, so no public claim changes. Not flagged for review; the record's write-up (row LH030-record) will carry the date.

From studies/LH030/checkpoints/2026-11-05.md in the repository, last changed 5 November 2026.