LUP 690: The S in PHP is for Security

• Air Date: 2026-10-25
• Duration: 71 mins 42 secs

About this episode

A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.

Your hosts

• Chris Fisher
• Wes Payne
• Brent Gervais

Sponsored by

• Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.

Episode links

• Web Boost — Send us a boost via sats or USD
• Jupiter Uplink
• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• ConnecTen Internet: promo Jupiter35
• MP3: Clanker Therapy 3: What Have You Been Building?
• YouTube: Clanker Therapy 3: What Have You Been Building?
• Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream
• PHP Security Release for PHP2Shell
• PHP2Shell: PHP Remote Code Execution
• Understanding PHP2Shell
• CVE-2026-109618 - PHP RCE via OOM corruption
• CVE-2026-109619 - PHP RCE via stale global state
• Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
• PHP: OOM corruption advisory
• PHP: stale global state advisory
• PHP's October 23 follow-up
• Steal My Bitcoin - a PHP RCE challenge! — Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!+ https://news.ycombinator.com/item?id=50224916
• People are using AI to make their smart TVs dumb again
• CleanYourTV — Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home.
• CleanYour.TV: remove ads and bloat from Android TV and Google TV
• cleanyourtv/addons/frigate-glance
• cleanyourtv/addons/smart-home
• cleanyourtv/addons/tv-hub
• humblemuzzu/dumbtv — Take the ads, tracking and clutter out of your Fire TV over ADB, no root. Every step can be undone. Comes with its own open-source home screen.
• Amazon.com: Xiaomi TV Box S 3rd Gen
• The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx
• KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List
• android-nixpkgs: Nix-packaged Android SDK
• LCARS - Wikipedia
• agent-shell - Emacs Agent Shell — Brings your favorite AI agents to Emacs, keeping you at home.
• HouseWaves — Home Assistant Whole-Home Multi-Room Speakers
• LeadStinger
• Niri — A scrollable-tiling Wayland compositor.
• Umbriel — Umbriel is a Wayland compositor designed for daily use, with scrolling, dwindle, master, and floating layouts, per-output workspaces, window rules, blur, shadows, and fluid animations.
• NetBird - Open Source Zero Trust Networking
• noblepayne/meshSidecar: Mesh network sidecars for NixOS Services
• Vero V - OSMC — Vero V is OSMC’s fifth flagship streaming media player that’s designed for fast, “future-proof” 4K playback, including AV-1 and HDR formats. It uses an AMLogic S905X4 processor with 4GB RAM and 32GB eMMC storage, and it connects with HDMI 2.1, gigabit Ethernet, and Wi‑Fi.
• HelixNotes - GitLab — A local, open-source Markdown note-taking app. No cloud, no account, no telemetry.
• Pick: Telescope — Use your phone's camera as a webcam on Linux or Windows, telephoto and wide lenses included.
• Telescope features.md - Telescope Docs
• Telescope: your phone as a webcam on Linux & Windows
• Pick: plex2jellyfin — Migrate your Plex library to Jellyfin and keep it clean forever. Mass rename, dedupe, consolidate, then a daemon guards new downloads.

Tags

adb, agent-shell, ai-assisted exploit, android tv, brotli, clanker therapy, cleanyourtv, cve, cve-2026-109618, cve-2026-109619, debloat, drupal, dumbtv, exploit, fire tv, google tv, helixnotes, home assistant, housewaves, ip camera, jellyfin, joomla, jupiter broadcasting, jupiter uplink, ksmbd, lcars, leadstinger, linux podcast, linux unplugged, memory corruption, memory exhaustion, memory safety, minimax m3.1, netbird, nextcloud, nginx, niri, nix android sdk, note taking, opcache, open source, osmc, php, php security, php-fpm, php2shell, plex, plex2jellyfin, privacy, quipclipper, remote code execution, rms, rtsp, rust, scrolling window manager, seagl, security, security patch, self-hosted, smart tv, stealmybitcoin.com, tailscale ssh, telescope, umbriel, use-after-free, vero v, vulnerability, we are brent, web security, webcam, wordpress