LH032 read: 5 November 2026

14:15 UTC, the Thursday read, under instrument 0.3 (the amendment of 2 November admitting "Runtime-dependent"). The repository was cloned fresh and complete; its head was NCSC-NL's merge 6673c70f39c8 (4 November 09:32:34 UTC+1 by the commit's own clock, 08:32 UTC), two first-parent commits after the 2 November head 60d6616dbbe3 (9337d58, 2 November 16:34 UTC+1, a phpMyFAQ change; 6673c70, "vendor-fixed-scopes"). analyse.py --compress read the head without error (summary); the list's files (software/*.md) and LICENSE are kept in list/.

At the head: 948 entries (929 at the 2 November head), 100 mainline commits.

	Fix	Vulnerable	Investigation	Runtime-dependent	Not vuln	blank
CVE-2026-109618	185	215	93	240	214	1
CVE-2026-109619	185	213	94	239	216	1

The README's own table at the head (statistics "as of 2026-11-04 (UTC)") reads 948, 185, 215, 93, 240, 214, 1, matching the CVE-2026-109618 row.

What changed since the 2 November head (derived, comparing entries by supplier and product name): 20 entries added and 1 removed, all with status Fix for both CVEs; no entry held at both reads changed status. The removed entry, "Part-DB official Docker image (PHP 8.4.27 rebuild)", reappears as "Part-DB official Docker images with patched PHP", so the net is 19 new identities. One addition is phpMyFAQ's official Docker images (4.2.0-RC.1), dated 2 November 16:34 UTC+1; the other 19 come from the 4 November commit and are of two kinds: vendors' hosted services described as rolled out with patched PHP (Centreon, EGroupware, Snipe-IT, MODX, Vtiger) and official container images with patched PHP (EGroupware, Snipe-IT, Invoice Ninja, Part-DB, ProjectSend, Pterodactyl, ownCloud), plus six Red Hat Enterprise Linux extended-support streams for PHP 8.0, 8.2 and 8.3 packages. All of the Fix increase is new entries, not reassessed old ones: the 93 "Investigation" and 240 "Runtime-dependent" entries are as on 2 November. The entries' first-listed times are the list's commit clock, not when each vendor's fix was published.

CVE-2026-115560: the root README still says the repository "does not track CVE-2026-115560 separately in the software list"; the status panel has columns for the two original CVEs only.

Advisory check run (the list changed), started 14:16 UTC: three of four sampled pages at HTTP 200; PHP's GitHub security advisory page refused (HTTP 403), as on 2 November (log). Written by the scheduled Thursday run.