LH031 reads: 27 October 2026

06:34 UTC: two of the three CVEs are now listed

Observation. CISA's feed, read at 06:34:14 UTC (HTTP 200, extract, read log, raw body SHA-256 653c72ea…), is catalogue version 2026.10.26, dateReleased 2026-10-26T22:24:24 UTC, 1,758 entries (1,756 at version 2026.10.23). It lists CVE-2026-109618 and CVE-2026-109619; CVE-2026-115560 is not listed.

Both entries' requiredAction reads: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." Their notes cite php.net, CISA's 21 October alert, BOD 26-04 and its implementation guidance, and NVD's record for each CVE.

Clocks, kept apart. CISA's dateAdded: 26 October (a day, no time). The feed's own dateReleased: 26 October 22:24:24 UTC. Lighthouse's reads bound the appearance from our side: absent at 26 October 18:34 UTC (version 2026.10.23), present at 27 October 06:34 UTC. Against the brief's comparison: PHP's notice of 20 October, its releases of 21 October and its notice of 23 October; Amazon's report of a 17 October honeypot attempt and Cloudflare's "early attacks" claim (LH028). CISA added the two CVEs five days after PHP's fixes, by its own date; that is a sequence of differently sourced clocks, not a delay to generalise.

What it is, per the brief. A catalogue entry is CISA's classification of a flaw as known to be exploited, by criteria the feed does not state (corrected 27 October before release: an earlier wording here said "reliable evidence", a criterion no retained source states; notes/R-0035-php-cisa-evidence.md, M1). It is not a count of attacks, a measure of compromise, or a statement about any named system, and the catalogue gives no evidence of its own. A dueDate three days after dateAdded and a forensic-triage flag are CISA's instructions to the agencies its directives cover. "Unknown" ransomware use is CISA's field value, not a finding of none.

Flagged for review: this changes how the public account reads. Version 1.1 of the PHP account rests its exploitation evidence on Amazon's honeypot report and Cloudflare's traffic claims, in a section titled "What the attack reports do and do not count", and does not mention CISA; a listing in CISA's catalogue is a published government classification of exploitation, quotable with attribution under AGENTS.md, and a different kind of record beside those two, whose own sources are not given. The account is not edited by this run; the next reviewed revision carries it. Written by the scheduled daily run.

12:37 UTC (amendment 1)

Catalogue version 2026.10.26, released 26 October 22:24:24 UTC, 1,758 entries; the two PHP entries are unchanged in every field since 06:34 UTC; CVE-2026-115560 not listed (extract).

18:34 UTC (amendment 1)

Catalogue version 2026.10.26, released 26 October 22:24:24 UTC, 1,758 entries; the two PHP entries are unchanged in every field since 06:34 UTC; CVE-2026-115560 not listed (extract).