Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH031

LH031 reads: 30 October 2026

06:34 UTC

Catalogue version 2026.10.29, released 29 October 19:09:34 UTC, 1,764 entries (two added since 2026.10.28); the two PHP entries are unchanged in every field; CVE-2026-115560 not listed (extract). Last daily read. Written by the scheduled daily run.

Correction, 30 October, about 11:55 UTC

The log entries for 28 and 29 October in notes/php-watch-log.md called each release's two additions "unrelated". These checkpoints said only "two added". Two of the additions were not unrelated, read from the retained feeds without a new fetch:

  • Catalogue 2026.10.28 (29 October checkpoint; feed) added CVE-2026-46300, a Linux kernel flaw dated 28 October and due 31 October. Its shortDescription ends: "This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root." It is present unchanged in 2026.10.29.
  • Catalogue 2026.10.27 (28 October; feed) added CVE-2026-111497 (Google Brotli). Its entry does not name PHP. It is the dependency flaw PHP's Windows rebuilds of 26 October address (LH030, 26 October checkpoint).

The other additions since 23 October (Plex, Siemens, SiteGuard, Arista, Collabora, Adobe Commerce, VMware ESX, GitLab, Cisco) do not mention PHP. The brief's frame is the three PHP CVEs, so no frame outcome changes. The miss came from checking only the three frame entries. From now on, a checkpoint names each added entry whose text mentions PHP or any of the three CVEs. Flagged for review with notes/php-leads-2026-10-30/leads.md.

13:04 UTC (amendment 1)

Catalogue version 2026.10.29, 1,764 entries, unchanged since 06:34 UTC; the two PHP entries unchanged in every field; CVE-2026-115560 not listed (extract).

From studies/LH031/checkpoints/2026-10-30.md in the repository, last changed 30 October 2026.