LH032 read: 2 November 2026 (partial)

15:26 UTC, the first Monday read after the daily reads ended. The clone was fresh and complete; its head was NCSC-NL's merge 60d6616dbbe3 (2 November 15:35 UTC+1 by the commit's own clock, which is 14:35 UTC). The analyser could not read that head. Since a commit at 10:43 (UTC+1) on 2 November the list carries a sixth status, "Runtime-dependent" (the README's statistics table now has a column for it: 240 of 929 products), and analyse.py stopped at its own reconciliation of the source fragments against the Markdown tables (status mismatch, first at WooCommerce), as its documentation says it will. It was not repaired here. The read is therefore partial: it is pinned to the last first-parent commit that reconciles, 640dcb0a9b72 (2 November 09:01:48 UTC+1, 08:01 UTC), five mainline commits behind the head (summary). The head's list files are kept unanalysed beside it (note).

At the pinned commit: 929 entries (925 on 30 October); for CVE-2026-109618, 165 Fix (153), 217 Vulnerable (223), 345 Investigation (348), 201 Not vuln (200), 1 blank; 92 mainline commits (87). The README's statistics table at that commit matches these counts (929, 165, 217, 345, 201, 1). At the head, the README's own table reads 929 tracked, 166 fixed, 215 vulnerable, 93 under investigation, 240 runtime-dependent, 214 not affected, 1 unassessed: most "Investigation" entries moved to "Runtime-dependent" in the last commits, a relabelling the instrument cannot yet count and whose meaning ("assess the linked PHP runtime or deployment; no direct product VEX status is asserted", in the list's words) is not a fix or a not-affected finding. Those head figures are the list's own table, not Lighthouse's reanalysis.

CVE-2026-115560: the status panel still has columns for the two original CVEs only; the README paragraph on it was not re-read.

Advisory check run (the list changed): four of five sampled pages at HTTP 200, PHP's GitHub security advisory page refused (HTTP 403) (log); it started at 15:27 UTC. For the driving session: the analyser needs the new status added before the Thursday read, and the 30-day statuses will not be comparable until it is.

Head audit under instrument 0.3, 2 November 2026

A derived audit, not a new read. The amendment of 2 November (made after these outcomes were seen) admits "Runtime-dependent" as a status of its own. The list's own definition, in software/README.md at the head: "The product/component has no direct VEX assertion; assess the linked supplied or containing PHP runtime/deployment." The clone used for today's read was no longer on disk, so the repository was cloned again before 15:36 UTC to obtain the same commit; its head was still 60d6616dbbe3, and nothing later was read. Outputs: head-audit (summary, transitions).

At 60d6616dbbe3, 98 mainline commits, 929 entries, all reconciled per package against the source fragments:

These agree with the list's own software/statistics/inventory-statistics.json at the head for both CVEs (the README's table matches the CVE-2026-109618 row).

From 640dcb0a9b72 to the head, the same 929 identities, none added or removed; 257 entries changed status for CVE-2026-109618 and 256 for CVE-2026-109619:

Of the 240 relabelled entries, 238 first show the new status at c005d3d (10:43 UTC+1) and 2 (WooCommerce, Virtualmin) at the head. The Investigation to Runtime-dependent moves are a relabelling by the list, not an assessment completed: only 14 entries per CVE moved to a vendor- or upstream-sourced resolution (13 Not vuln, 1 Fix) in these six mainline commits (c005d3d to 60d6616; the head is six first-parent commits after the pin, 92 to 98, not five as the paragraph above says). The one entry where the CVEs differ is The PHP Group's "PHP Session" (Runtime-dependent for CVE-2026-109618, Fix for CVE-2026-109619).