LH032 read: 26 October 2026

List: the clone fetched at about 06:35 UTC. NCSC-NL's list has new commits for the first time since 23 October 12:50:49 UTC: head 3b68e919dd24 (committed 26 October 02:46:58 UTC, "Merge pull request #46"), two more first-parent commits in the analyser's history (67 against 65). They include a commit titled "Verify eligible PHP products against official public advisories" (0061ee2, 02:09 UTC) and a contributed entry for GetPageSpeed's PHP 5.6 to 8.4 packages for CentOS 7 / EL7, scoped by NCSC to verified builds (9be0786). The repaired analyser's counts (summary) against the 25 October read:

	25 October	26 October
Entries	751	752
CVE-2026-109618: Fix / Vulnerable / Investigation / Not vuln	109 / 222 / 389 / 30	119 / 216 / 378 / 38
CVE-2026-109619: Fix / Vulnerable / Investigation / Not vuln	109 / 220 / 390 / 31	118 / 214 / 380 / 39
Entries linking a URL / with an advisory-typed URL	749 / 202	750 / 210
Entries whose status ever changed	308	322

No column for CVE-2026-115560, and the diff since 2fdc314 does not mention it. Which entries moved, and why, is in the retained entries and source files; this checkpoint does not attribute the changes beyond the commit titles.

Advisory check (read log, selection), run because the list changed. The rule selects the same five entries as on 24 October (aaPanel, AWS Elastic Beanstalk, Arch PHP and php-legacy, BookStack), still labelled Fix, and all four pages answered 200 and still name the fixed releases. Arch's and BookStack's pages are byte-identical to 24 October; aaPanel's and AWS's differ in bytes, but their own dates did not move (aaPanel's page modified 23 October 10:18 UTC; AWS's bulletin last updated 23 October 13:30 PDT), so the changes were not read further. Five of five still supported; this checks five entries, not the list's accuracy. Written by the scheduled daily run.