LH032 read: 9 November 2026

In short. Monday's read of the Dutch NCSC's public list of products that embed PHP. The list grew from 948 to 968 entries, all added on 9 November: AlmaLinux and Rocky Linux packages and modules, 18 of them recorded as fixed and two of Rocky's still under investigation. Fortinet's FortiSOAR entries moved from under investigation to fixed. The list still does not track the newer flaw, CVE-2026-115560, separately.

14:25 UTC, the Monday read, under instrument 0.3. The repository was cloned fresh and complete; its head is NCSC-NL's merge a441677e6095 (9 November 09:58:09 UTC+1 by the commit's own clock, 08:58 UTC), two first-parent commits after the 5 November head 6673c70f39c8: 2709f5d (9 November 09:39:24 UTC+1, "updated-software-list-20261106-091228") and a441677 (a contributed pull request, merged with a commit "align distro PHP assessments with official evidence"). analyse.py --compress read the head without error (summary); software/*.md and LICENSE are kept in list/. The clone and the advisory check were the first under the keeper's robots.txt rule: github.com's robots.txt answered HTTP 403 to this session, which RFC 9309 treats as no rules, and every advisory URL was allowed.

At the head: 968 entries (948 at the 5 November head), 102 mainline commits.

What changed since the 5 November head (derived, comparing entries by supplier and product name): 20 entries added and none removed, all first listed at a441677: 11 AlmaLinux and 9 Rocky Linux package sets or modules (for PHP 7.2 to 8.4 across releases 8, 9 and 10). 18 record Fix for both CVEs; Rocky Linux 8's and 9's "PHP RPM/AppStreams" entries record Investigation. Two entries held at both reads changed status, at 2709f5d: Fortinet's FortiSOAR and FortiSOAR PaaS, from Investigation to Fix for both CVEs, with versions "8.0.1 or later; 8.0.0 + Security Patch #2; 7.6.7 or 7.5.4 + Security Patch #1" (consistent with Fortinet's own statement read by LH037 on 5 November). The Investigation column's total is unchanged because the two Rocky additions balance the two FortiSOAR moves.

CVE-2026-115560: the root README still says the repository "does not track CVE-2026-115560 separately in the software list", and now advises keeping session.upload_progress.enabled=0 "until the next regular PHP bugfix release".

Advisory check run (the list changed), started 14:26 UTC: four of five sampled pages at HTTP 200 (aaPanel's forum and three AlmaLinux errata, newly in the first five that link one); PHP's GitHub security advisory page refused (HTTP 403), as before (log). Not flagged for review. Written by the scheduled Monday run.