Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH032

LH032 read: 24 October 2026

List: the clone fetched at about 06:36 UTC; NCSC-NL's list has no new commit since 23 October 12:50:49 UTC (head 2fdc314ded28), so the repaired analyser's counts (summary) equal the audited baseline: 751 entries; for CVE-2026-109618, 109 Fix, 222 Vulnerable, 389 Investigation, 30 Not vuln; 749 link a URL; no column for CVE-2026-115560. The list's Markdown files at that commit are copied to list/. Written by the scheduled daily run (Claude Code driving session, Claude Opus 5.5).

Sample check of vendor advisories (script, read log, selection). The first five entries with a source-typed advisory URL in the list's case-insensitive order, as review/plan.md named them, which completes the sample yesterday's late check left incomplete: four unique pages, all HTTP 200, 06:3x UTC.

  • aaPanel (Fix): its forum notice lists PHP's fixed releases and the source backports, gives in-panel update steps, and says aaPanel built its own patched versions for PHP 7.0 to 7.3. Supports the list's Fix as a panel-provided update path; the panel's builds were not examined.
  • AWS Elastic Beanstalk (Fix): readable this time (yesterday's late check got a placeholder). Bulletin 2026-143-AWS, last updated 23 October 13:30 PDT, says updated platform versions for PHP 8.2 to 8.5 are released. Supports the label, as AWS's claim. Since LH024's 23 October copy it also names affected Amazon EMR releases (clusters with Ganglia), points Lambda users to Bref's release, and says Amazon Linux packages are available in all regions.
  • Arch PHP and php-legacy (Fix): one notice, dated 21 October, says versions before 8.5.12 and 8.3.36 are affected and urges upgrading. Supports both labels.
  • BookStack (Fix): its post, "last updated 23rd October at 23:03 UTC", gives the remedy as updating the hosting PHP runtime and lists the four fixed releases. Supports the Fix as runtime-scoped. It also relays PHP's 23 October session upload progress advice, saying BookStack "does not appear to set the conditions" and giving session.upload_progress.enabled=0 as an option. That page is outside LH030's frame and is recorded here only.

Five of five sampled entries are supported by readable first-party pages at this read. This checks five entries, not the list's accuracy.

From studies/LH032/checkpoints/2026-10-24.md in the repository, last changed 24 October 2026.