# The S in PHP is for Security

URL: /show/linux-unplugged/690/
> A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.

- Show: [LINUX Unplugged](/show/linux-unplugged/)
- Episode: 690
- Date: 2026-10-25
- Hosts: brent, chris, wes
- Duration: 01:11:42
- Audio: https://dts.podtrac.com/redirect.mp3/mgln.ai/e/211/rss.art19.com/episodes/17d09551-573f-472f-b74e-0372a14d9a89.mp3


Transcripts: [text/vtt](https://feeds.jupiterbroadcasting.com/transcripts/lup/001d7139-1aed-4d0f-9f38-91cbc11cda8b.vtt) [application/x-subrip](https://feeds.jupiterbroadcasting.com/transcripts/lup/001d7139-1aed-4d0f-9f38-91cbc11cda8b.srt)


Sponsors:
- [Nebula](/sponsors/defined.net-lup/index.md): Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
- [Incogni](/sponsors/incogni.com-lup/index.md): They can't harm you if they can't find you! Take back control of your personal data today. Go to incogni.com/unplugged and use code UNPLUGGED for 60% off an annual plan. It's completely risk-free with a 30-day money-back guarantee.
- [Namecheap](/sponsors/namecheap.promo-lup/index.md): Use code UNPLUGGED for an extra 15% off VPS hosting.




### Episode Links

* [Web Boost](https://boost.jupiterbroadcasting.com/?show=lup "Web Boost") — Send us a boost via sats or USD
* [Jupiter Uplink](https://uplink.jupiterbroadcasting.com/ "Jupiter Uplink")
* [💥 Gets Sats Quick and Easy with Strike](https://strike.me/ "💥 Gets Sats Quick and Easy with Strike")
* [📻 LINUX Unplugged on Fountain.FM](https://www.fountain.fm/show/dWiuBeqpDSM86AwXRXov "📻 LINUX Unplugged on Fountain.FM")
* [ConnecTen Internet: promo Jupiter35](https://connecteninternet.com/discount/Jupiter35 "ConnecTen Internet: promo Jupiter35")
* [MP3: Clanker Therapy 3: What Have You Been Building?](https://extras.show/95 "MP3: Clanker Therapy 3: What Have You Been Building?")
* [YouTube: Clanker Therapy 3: What Have You Been Building?](https://www.youtube.com/watch?v=Cyz-DeDXJbc "YouTube: Clanker Therapy 3: What Have You Been Building?")
* [Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream](https://jupitersignal.memberful.com/posts/114789 "Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream")
* [PHP Security Release for PHP2Shell](https://www.php.net/index.php#2026-10-21-5 "PHP Security Release for PHP2Shell")
* [PHP2Shell: PHP Remote Code Execution](https://www.wiz.io/blog/php2shell-php-rce "PHP2Shell: PHP Remote Code Execution")
* [Understanding PHP2Shell](https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know "Understanding PHP2Shell")
* [CVE-2026-109618 - PHP RCE via OOM corruption](https://nvd.nist.gov/vuln/detail/cve-2026-109618 "CVE-2026-109618 - PHP RCE via OOM corruption")
* [CVE-2026-109619 - PHP RCE via stale global state](https://nvd.nist.gov/vuln/detail/cve-2026-109619 "CVE-2026-109619 - PHP RCE via stale global state")
* [Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers](https://cybersecuritynews.com/tailscale-ssh-flaws/ "Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers")
* [PHP: OOM corruption advisory](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w "PHP: OOM corruption advisory")
* [PHP: stale global state advisory](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp "PHP: stale global state advisory")
* [PHP's October 23 follow-up](https://www.php.net/archive/2026.php#2026-10-23-1 "PHP's October 23 follow-up")
* [Steal My Bitcoin - a PHP RCE challenge!](https://stealmybitcoin.com/ "Steal My Bitcoin - a PHP RCE challenge!") — Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!+ https://news.ycombinator.com/item?id=50224916
* [People are using AI to make their smart TVs dumb again](https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again/ "People are using AI to make their smart TVs dumb again")
* [CleanYourTV](https://github.com/Gathin23/cleanyourtv "CleanYourTV") — Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home.
* [CleanYour.TV: remove ads and bloat from Android TV and Google TV](https://cleanyour.tv/ "CleanYour.TV: remove ads and bloat from Android TV and Google TV")
* [cleanyourtv/addons/frigate-glance](https://github.com/Gathin23/cleanyourtv/tree/main/addons/frigate-glance "cleanyourtv/addons/frigate-glance")
* [cleanyourtv/addons/smart-home](https://github.com/Gathin23/cleanyourtv/tree/main/addons/smart-home "cleanyourtv/addons/smart-home")
* [cleanyourtv/addons/tv-hub](https://github.com/Gathin23/cleanyourtv/tree/main/addons/tv-hub "cleanyourtv/addons/tv-hub")
* [humblemuzzu/dumbtv](https://github.com/humblemuzzu/dumbtv "humblemuzzu/dumbtv") — Take the ads, tracking and clutter out of your Fire TV over ADB, no root. Every step can be undone. Comes with its own open-source home screen.
* [Amazon.com: Xiaomi TV Box S 3rd Gen](https://www.amazon.com/Xiaomi-TV-Box-3rd-Gen/dp/B0F3JWFL56 "Amazon.com: Xiaomi TV Box S 3rd Gen")
* [The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx](https://pretalx.seagl.org/2026/talk/HTMWCX/ "The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx")
* [KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List](https://cybersecuritynews.com/linux-kernel-flaws-accidentally-disclosed/ "KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List")
* [android-nixpkgs: Nix-packaged Android SDK](https://github.com/tadfisher/android-nixpkgs "android-nixpkgs: Nix-packaged Android SDK")
* [LCARS - Wikipedia](https://en.wikipedia.org/wiki/LCARS "LCARS - Wikipedia")
* [agent-shell - Emacs Agent Shell](https://github.com/xenodium/agent-shell "agent-shell - Emacs Agent Shell") — Brings your favorite AI agents to Emacs, keeping you at home.
* [HouseWaves](https://gethousewaves.com/ "HouseWaves") — Home Assistant Whole-Home Multi-Room Speakers
* [LeadStinger](https://github.com/weckere/leadstinger "LeadStinger")
* [Niri](https://github.com/niri-wm/niri "Niri") — A scrollable-tiling Wayland compositor.
* [Umbriel](https://github.com/noctalia-dev/umbriel "Umbriel") — Umbriel is a Wayland compositor designed for daily use, with scrolling, dwindle, master, and floating layouts, per-output workspaces, window rules, blur, shadows, and fluid animations.
* [NetBird - Open Source Zero Trust Networking](https://netbird.io/ "NetBird - Open Source Zero Trust Networking")
* [noblepayne/meshSidecar: Mesh network sidecars for NixOS Services](https://github.com/noblepayne/meshSidecar "noblepayne/meshSidecar: Mesh network sidecars for NixOS Services")
* [Vero V - OSMC](https://osmc.tv/vero/ "Vero V - OSMC") — Vero V is OSMC’s fifth flagship streaming media player that’s designed for fast, “future-proof” 4K playback, including AV-1 and HDR formats. It uses an AMLogic S905X4 processor with 4GB RAM and 32GB eMMC storage, and it connects with HDMI 2.1, gigabit Ethernet, and Wi‑Fi.
* [HelixNotes - GitLab](https://gitlab.com/ArkHost/HelixNotes "HelixNotes - GitLab") — A local, open-source Markdown note-taking app. No cloud, no account, no telemetry.
* [Pick: Telescope](https://github.com/LunarKittyy/Telescope "Pick: Telescope") — Use your phone's camera as a webcam on Linux or Windows, telephoto and wide lenses included.
* [Telescope features.md - Telescope Docs](https://github.com/LunarKittyy/Telescope/blob/master/docs/features.md "Telescope features.md - Telescope Docs")
* [Telescope: your phone as a webcam on Linux & Windows](https://telescope.webcam/ "Telescope: your phone as a webcam on Linux & Windows")
* [Pick: plex2jellyfin](https://github.com/Nomadcxx/plex2jellyfin "Pick: plex2jellyfin") — Migrate your Plex library to Jellyfin and keep it clean forever. Mass rename, dedupe, consolidate, then a daemon guards new downloads.