Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH032

LH032 read: 28 October 2026

06:34 UTC. NCSC-NL's list has eight new mainline commits since 26 October 02:46:58 UTC, the last at 27 October 14:51:36 UTC (head 1d605e33471f) (summary): 757 entries (752 before); for CVE-2026-109618, 132 Fix (119), 219 Vulnerable (216), 365 Investigation (378), 40 Not vuln (38), 1 blank. New or changed rows include Broadcom (SpanVA Vulnerable, CASMA Investigation), Ubiquiti UISP CRM (Fix), Cleo Streem (Fix) and GetPageSpeed's Ubuntu and Debian builds (Fix).

No column for CVE-2026-115560. The repository's README now names it for the first time: "On 23 October 2026, PHP published an informational advisory suggesting session.upload_progress.enabled=0 until the next regular bugfix release to fully protect from an unlikely RCE vector (CVE-2026-115560). PHP will publish a full advisory with the next release; this repository does not track CVE-2026-115560 separately in the software list." It gives no affected or fixed version; it restates PHP's own notice, which the account already reports. NCSC-NL's words, not an observation.

Advisory check run (the list changed): five sampled advisory pages, all HTTP 200 (log). Written by the scheduled daily run.

From studies/LH032/checkpoints/2026-10-28.md in the repository, last changed 28 October 2026.