Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH030

LH030 reads: 9 November 2026

In short. Monday's read of how PHP's 23 October instruction about the newer flaw travels. Nothing changed: SUSE still holds the only tracker record for CVE-2026-115560, unchanged since 4 November, and no other tracker or notice in the panel changed its classes. PHP has made no regular 8.x release since 21 October, so the study goes on; PHP's own page now says the first 8.6.0 release is planned for 19 November.

Read at 14:23 UTC (label 2026-11-09T1423Z)

Monday read, the first under the keeper's robots.txt rule of 8 November 2026: the collector now asks scripts/robots_gate.py before each request (scripts/lh_fetch.py; brief amendment of 9 November) and every panel URL was allowed. A first attempt at 14:22 UTC failed to save any body because of a bug in that change; its read log is kept as a record of the requests (FAILED.md) and no measure uses it.

No class changed against the 14:14 read of 5 November (read log, classes). SUSE's page for CVE-2026-115560 is byte for byte the 5 November page: "Analysis", moderate severity, no fixed package, "last modified: Wed Nov 4 17:54:00 2026". CVE Program, OSV, Debian and Red Hat answered HTTP 404 and NVD returned zero results: no record. Ubuntu's request timed out, so Ubuntu's state at this read is unknown, not no record (HTTP 503 on 5 November). CISA's alert page and Akamai refused (HTTP 403), as before.

Pages that differ in bytes but not in classes or IV snippets: CERT-EU, Cloudflare, Fastly (both pages; the documentation page is about a quarter of its former size and still does not name the issue), Google Cloud's two pages, and NVD's empty answer. IV decisions are carried over (hand_iv.json).

PHP's news page has one new entry, of 5 November: "PHP 8.6.0 RC5 available for testing", a pre-release ("Please DO NOT use this version in production"), which says "The next release will be the first GA release, PHP 8.6.0, planned for 19 November 2026". It does not mention the session upload progress issue.

Stop condition, as of this read: not met. No regular 8.x release since 21 October: php.net's releases JSON (/releases/index.php?json&version=8, allowed by robots.txt, read at 14:24 UTC without retention) still gives 8.5.12 of 21 October as the latest. Whether 8.6.0, a new minor version rather than a patch release on the four supported branches, counts as "PHP's next regular 8.x release" for the stop is a question for the record; the record will say which it takes and why, before reading what 8.6.0 contains. The brief's last date is 30 November 2026.

Not flagged for review: nothing here changes a public account.

From studies/LH030/checkpoints/2026-11-09.md in the repository, last changed 9 November 2026.