Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH031

LH031 reads: 9 November 2026

In short. Monday's read of CISA's catalogue of exploited flaws and of Palo Alto Networks' PHP advisory. The two PHP flaws are listed as before and the newer one, CVE-2026-115560, is still not listed. Palo Alto's advisory and Unit 42's brief are unchanged; the advisory's machine-readable file was regenerated with the same fixed builds under new internal product numbers.

Catalogue read at 14:25 UTC (label 2026-11-09T1425Z)

The first read under the keeper's robots.txt rule (scripts/lh_fetch.py; brief amendment of 9 November): every request was allowed. Catalogue version 2026.11.06, released 6 November 19:44:45 UTC, 1,769 entries; one added since 2026.11.04: CVE-2026-19868, SonicWall SonicOS SSLVPN, dateAdded 6 November, whose text names neither PHP nor one of the three CVEs, so it is not a mention under the criteria (extract). CVE-2026-109618 and CVE-2026-109619 are listed with dateAdded 26 October, unchanged in every field against the 5 November 14:14 read. CVE-2026-115560 is not listed: no new KEV entry among the three CVEs. The mentions list is the same 26 entries.

Vendor read at 14:25 UTC (label 2026-11-09T1425Z, amendment 5)

Advisory, CSAF and Unit 42 each answered HTTP 200 (read log, extract), classed against the 5 November read.

  • Advisory: unchanged in every extracted field (Published 2026-10-21, Updated 2026-10-29, Exploit Maturity ATTACKED, the same 20 fixed builds and sentences).
  • Unit 42: unchanged (title "(Updated October 29)", one update heading, the same sentences).
  • CSAF: current_release_date is now 2026-11-03T20:13:55.166Z (20:15:10.977Z at the last read, so 75 seconds earlier), with the same 16 revision entries and no new one. The 20 fixed product identifiers changed (now PANW-PAN-OS-926 onwards, before 930 onwards), but the product names they resolve to are the same 20 builds. A regenerated file, by appearance; no change in what the vendor says is fixed, and none in its exploitation sentences.

Not flagged for review: nothing here changes a public account.

From studies/LH031/checkpoints/2026-11-09.md in the repository, last changed 9 November 2026.