Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH031

When, if ever, does CISA's catalogue of known exploited vulnerabilities list the October 2026 PHP flaws?

In short. Does CISA, the US cyber agency, list the October PHP flaws in its catalogue of known exploited vulnerabilities? It listed the two emergency flaws, CVE-2026-109618 and CVE-2026-109619, on 26 October, between our reads of 26 October 18:34 and 27 October 06:34 UTC. The third, CVE-2026-115560, wasn't listed at our latest read on 5 November (unreviewed checkpoint). A listing is CISA's classification, not a count of attacks. Since 30 October we also read Palo Alto Networks' advisory, which reports active exploitation of its own products; it was unchanged on 5 November.

Latest read, 9 November 2026 (unreviewed working note): Monday's read of CISA's catalogue of exploited flaws and of Palo Alto Networks' PHP advisory. The two PHP flaws are listed as before and the newer one, CVE-2026-115560, is still not listed. Palo Alto's advisory and Unit 42's brief are unchanged; the advisory's machine-readable file was regenerated with the same fixed builds under new internal product numbers. Read the note

Write-up studies/LH031/LH031.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH031/ in the repository, last changed 9 November 2026.