Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH039

WordPress core CVE-2026-119977: what the public sources can show, read before the brief

In short. WordPress fixed a flaw in its own update process on 28 October 2026, in 7.1.4 and in a release on every branch back to 4.7, and we want to know how fast sites moved to the fixed releases. Before writing a brief we read the sources' metadata, and found that WordPress.org's public version statistics count branches (7.1, 7.0), not releases (7.1.4), so they cannot by themselves tell a fixed site from an unfixed one. The brief had to choose between sources that see releases, each counting something different; it was fixed on 8 November as brief.md, with W3Techs's survey of websites and Packagist's developer downloads, and the raw reads from 7 November on are its first days.

Working note (study LH039, proposals.md P-0017), before any brief is fixed, 7 November 2026 studies/LH039/before-the-brief.md

From studies/LH039/ in the repository, last changed 9 November 2026.