LH033 checkpoint, 27 October 2026
Working record, unreviewed. Read at 06:37 UTC (Censys only); Censys's snapshot says it was refreshed at 06:15 UTC. Tables: data/read-2026-10-27T0637Z/tables.json. Completed days run from day 0 (21 October) to day 5 (26 October). Written by the scheduled daily run.
Revisions
None: days 0 to 4 are identical, field for field, to the read of 26 October.
Censys: share of version-reporting services in each fixed branch counted as patched (observation, its classification)
| Branch | Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | Services in branch, day 5 |
|---|---|---|---|---|---|---|
| 8.2 | 22.1% | 41.2% | 46.1% | 48.1% | 49.6% | 5.81 million |
| 8.3 | 23.8% | 42.2% | 45.9% | 47.8% | 49.0% | 7.60 million |
| 8.4 | 35.3% | 58.5% | 62.3% | 63.5% | 64.5% | 3.12 million |
| 8.5 | 36.1% | 70.5% | 73.3% | 74.5% | 75.7% | 3.18 million |
Day 5 added 1.0 to 1.5 points in each branch. 8.2 and 8.3 remain below half (49.6 and 49.0 per cent).
Censys: the tail no fix reaches
Day 5: 23.8 million services on branches PHP did not fix, 54.7 per cent of the 43.5 million that reported a version. Services reporting no version: 59.6 million, 57.8 per cent of all PHP services counted.
Chart
Redrawn from this read. The branch labels and the description now give one decimal place, so that 49.6 per cent is not shown as "50%", which would read as half; checked in light and dark.
Context, not a measure here
CISA's catalogue added CVE-2026-109618 and CVE-2026-109619 on 26 October (LH031). This study's counts are versions reported by services, which a catalogue entry does not change; the interim checkpoint will set the dates side by side without reading any effect into them.
From studies/LH033/checkpoints/2026-10-27.md in the repository, last changed 27 October 2026.