Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH033

How does the PHP emergency fix reach the services others count, beside how Python releases reached downloads?

In short. After PHP's emergency fix of 21 October, how many internet-facing PHP servers took it? We use Censys's public counts of servers that report their PHP version, and its patched share is a floor. By day 14 (4 November, unreviewed checkpoint) the share counted as patched was 73 per cent in branch 8.2, 70 in 8.3, 81 in 8.4 and 90 in 8.5. On day 7, 24.4 million servers, 54 per cent of those reporting a version, ran branches PHP no longer fixes. This record stops at day 7; the day-30 read is due on 21 or 22 November.

Latest read, 9 November 2026 (unreviewed working note): By Censys's count, 18 days after PHP's emergency fix, between about 72 and 90 per cent of internet-facing services in each fixed branch that report a version are counted patched, rising slowly. About 23 million services, 52 per cent of those reporting a version, still run branches PHP did not fix. W3Techs' survey, read today for the first time since 2 November, now puts roughly twice as large a share of each branch's websites at or above the fixed release as it did a week ago. Working record, unreviewed. Read the note

Study, version 0.1 (interim, to day 7), 30 October 2026 studies/LH033/LH033.md

Checkpoints

The working notes written at each read, newest first. They are unreviewed: a finding reaches a piece only after review.

From studies/LH033/ in the repository, last changed 9 November 2026.