Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH032

How do fixes for the October 2026 PHP flaws reach products that embed PHP, as one national CERT's public list records them?

In short. The Dutch national cyber security centre, NCSC-NL, keeps a public list of software affected by the October PHP flaws, with a status for each entry, and we read it twice a week. On 5 November (unreviewed checkpoint) it had 948 entries; for CVE-2026-109618, 185 had a fix, 215 were vulnerable, 93 were still being assessed, 240 were marked as depending on the PHP runtime they run on, and 214 were not vulnerable. These are the list's statuses, not what vendors or their customers actually run.

Latest read, 9 November 2026 (unreviewed working note): Monday's read of the Dutch NCSC's public list of products that embed PHP. The list grew from 948 to 968 entries, all added on 9 November: AlmaLinux and Rocky Linux packages and modules, 18 of them recorded as fixed and two of Rocky's still under investigation. Fortinet's FortiSOAR entries moved from under investigation to fixed. The list still does not track the newer flaw, CVE-2026-115560, separately. Read the note

Write-up studies/LH032/LH032.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH032/ in the repository, last changed 9 November 2026.