690: The S in PHP is for Security

A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs. Sponsored By: - Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love. Support LINUX Unplugged Links: - [Web Boost](https://boost.jupiterbroadcasting.com/?show=lup "Web Boost") — Send us a boost via sats or USD - [Jupiter Uplink](https://uplink.jupiterbroadcasting.com/ "Jupiter Uplink") - [💥 Gets Sats Quick and Easy with Strike](https://strike.me/ "💥 Gets Sats Quick and Easy with Strike") - [📻 LINUX Unplugged on Fountain.FM](https://www.fountain.fm/show/dWiuBeqpDSM86AwXRXov "📻 LINUX Unplugged on Fountain.FM") - [ConnecTen Internet: promo Jupiter35](https://connecteninternet.com/discount/Jupiter35 "ConnecTen Internet: promo Jupiter35") - [MP3: Clanker Therapy 3: What Have You Been Building?](https://extras.show/95 "MP3: Clanker Therapy 3: What Have You Been Building?") - [YouTube: Clanker Therapy 3: What Have You Been Building?](https://www.youtube.com/watch?v=Cyz-DeDXJbc "YouTube: Clanker Therapy 3: What Have You Been Building?") - [Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream](https://jupitersignal.memberful.com/posts/114789 "Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream") - [PHP Security Release for PHP2Shell](https://www.php.net/index.php#2026-10-21-5 "PHP Security Release for PHP2Shell") - [PHP2Shell: PHP Remote Code Execution](https://www.wiz.io/blog/php2shell-php-rce "PHP2Shell: PHP Remote Code Execution") - [Understanding PHP2Shell](https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know "Understanding PHP2Shell") - [CVE-2026-109618 - PHP RCE via OOM corruption](https://nvd.nist.gov/vuln/detail/cve-2026-109618 "CVE-2026-109618 - PHP RCE via OOM corruption") - [CVE-2026-109619 - PHP RCE via stale global state](https://nvd.nist.gov/vuln/detail/cve-2026-109619 "CVE-2026-109619 - PHP RCE via stale global state") - [Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers](https://cybersecuritynews.com/tailscale-ssh-flaws/ "Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers") - [PHP: OOM corruption advisory](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w "PHP: OOM corruption advisory") - [PHP: stale global state advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp "PHP: stale global state advisory") - [PHP's October 23 follow-up](https://www.php.net/archive/2026.php#2026-10-23-1 "PHP's October 23 follow-up") - [Steal My Bitcoin - a PHP RCE challenge!](https://stealmybitcoin.com/ "Steal My Bitcoin - a PHP RCE challenge!") — Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!+ https://news.ycombinator.com/item?id=50224916 - [People are using AI to make their smart TVs dumb again](https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again/ "People are using AI to make their smart TVs dumb again") - [CleanYourTV](https://github.com/Gathin23/cleanyourtv "CleanYourTV") — Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home. - [CleanYour.TV: remove ads and bloat from Android TV and Google TV](https://cleanyour.tv/ "CleanYour.TV: remove ads and bloat from Android TV and Google TV") - [cleanyourtv/addons/frigate-glance](https://github.com/Gathin23/cleanyourtv/tree/main/addons/frigate-glance "cleanyourtv/addons/frigate-glance") - [cleanyourtv/addons/smart-home](https://github.com/Gathin23/cleanyourtv/tree/main/addons/smart-home "cleanyourtv/addons/smart-home") - [cleanyourtv/addons/tv-hub](https://github.com/Gathin23/cleanyourtv/tree/main/addons/tv-hub "cleanyourtv/addons/tv-hub") - [humblemuzzu/dumbtv](https://github.com/humblemuzzu/dumbtv "humblemuzzu/dumbtv") — Take the ads, tracking and clutter out of your Fire TV over ADB, no root. Every step can be undone. Comes with its own open-source home screen. - [Amazon.com: Xiaomi TV Box S 3rd Gen](https://www.amazon.com/Xiaomi-TV-Box-3rd-Gen/dp/B0F3JWFL56 "Amazon.com: Xiaomi TV Box S 3rd Gen") - [The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx](https://pretalx.seagl.org/2026/talk/HTMWCX/ "The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx") - [KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List](https://cybersecuritynews.com/linux-kernel-flaws-accidentally-disclosed/ "KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List") - [android-nixpkgs: Nix-packaged Android SDK](https://github.com/tadfisher/android-nixpkgs "android-nixpkgs: Nix-packaged Android SDK") - [LCARS - Wikipedia](https://en.wikipedia.org/wiki/LCARS "LCARS - Wikipedia") - [agent-shell - Emacs Agent Shell](https://github.com/xenodium/agent-shell "agent-shell - Emacs Agent Shell") — Brings your favorite AI agents to Emacs, keeping you at home. - [HouseWaves](https://gethousewaves.com/ "HouseWaves") — Home Assistant Whole-Home Multi-Room Speakers - [LeadStinger](https://github.com/weckere/leadstinger "LeadStinger") - [Niri](https://github.com/niri-wm/niri "Niri") — A scrollable-tiling Wayland compositor. - [Umbriel](https://github.com/noctalia-dev/umbriel "Umbriel") — Umbriel is a Wayland compositor designed for daily use, with scrolling, dwindle, master, and floating layouts, per-output workspaces, window rules, blur, shadows, and fluid animations. - [NetBird - Open Source Zero Trust Networking](https://netbird.io/ "NetBird - Open Source Zero Trust Networking") - [noblepayne/meshSidecar: Mesh network sidecars for NixOS Services](https://github.com/noblepayne/meshSidecar "noblepayne/meshSidecar: Mesh network sidecars for NixOS Services") - [Vero V - OSMC](https://osmc.tv/vero/ "Vero V - OSMC") — Vero V is OSMC’s fifth flagship streaming media player that’s designed for fast, “future-proof” 4K playback, including AV-1 and HDR formats. It uses an AMLogic S905X4 processor with 4GB RAM and 32GB eMMC storage, and it connects with HDMI 2.1, gigabit Ethernet, and Wi‑Fi. - [HelixNotes - GitLab](https://gitlab.com/ArkHost/HelixNotes "HelixNotes - GitLab") — A local, open-source Markdown note-taking app. No cloud, no account, no telemetry. - [Pick: Telescope](https://github.com/LunarKittyy/Telescope "Pick: Telescope") — Use your phone's camera as a webcam on Linux or Windows, telephoto and wide lenses included. - [Telescope features.md - Telescope Docs](https://github.com/LunarKittyy/Telescope/blob/master/docs/features.md "Telescope features.md - Telescope Docs") - [Telescope: your phone as a webcam on Linux & Windows](https://telescope.webcam/ "Telescope: your phone as a webcam on Linux & Windows") - [Pick: plex2jellyfin](https://github.com/Nomadcxx/plex2jellyfin "Pick: plex2jellyfin") — Migrate your Plex library to Jellyfin and keep it clean forever. Mass rename, dedupe, consolidate, then a daemon guards new downloads.