The S in PHP is for Security | LINUX Unplugged 690

A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.
Sponsored By:
• Managed Nebula (defined.net/unplugged): Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love. (defined.net/unplugged)
Support LINUX Unplugged (jupitersignal.memberful.com/checkout?plan=52946)
Links:
• Web Boost (boost.jupiterbroadcasting.com/?show=lup) — Send us a boost via sats or USD
• Jupiter Uplink (uplink.jupiterbroadcasting.com)
• 💥 Gets Sats Quick and Easy with Strike (strike.me)
• 📻 LINUX Unplugged on Fountain.FM (fountain.fm/show/dWiuBeqpDSM86AwXRXov)
• ConnecTen Internet: promo Jupiter35 (connecteninternet.com/discount/Jupiter35)
• MP3: Clanker Therapy 3: What Have You Been Building? (extras.show/95)
• YouTube: Clanker Therapy 3: What Have You Been Building? (youtube.com/watch?v=Cyz-DeDXJbc)
• Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream (jupitersignal.memberful.com/posts/114789)
• PHP Security Release for PHP2Shell (php.net/index.php#2026-10-21-5)
• PHP2Shell: PHP Remote Code Execution (wiz.io/blog/php2shell-php-rce)
• Understanding PHP2Shell (akamai.com/blog/security-research/understandin…)
• CVE-2026-109618 - PHP RCE via OOM corruption (nvd.nist.gov/vuln/detail/cve-2026-109618)
• CVE-2026-109619 - PHP RCE via stale global state (nvd.nist.gov/vuln/detail/cve-2026-109619)
• Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers (cybersecuritynews.com/tailscale-ssh-flaws)
• PHP: OOM corruption advisory (github.com/php/php-src/security/advisories/GHS…)
• PHP: stale global state advisory (github.com/php/php-src/security/advisories/GHS…)
• PHP's October 23 follow-up (php.net/archive/2026.php#2026-10-23-1)
• Steal My Bitcoin - a PHP RCE challenge! (stealmybitcoin.com) — Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!+ news.ycombinator.com/item?id=50224916
• People are using AI to make their smart TVs dumb again (techcrunch.com/2026/10/19/people-are-using-ai-…)
• CleanYourTV (github.com/Gathin23/cleanyourtv) — Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home.
• CleanYour.TV: remove ads and bloat from Android TV and Google TV (cleanyour.tv)
• cleanyourtv/addons/frigate-glance (github.com/Gathin23/cleanyourtv/tree/main/addo…)
• cleanyourtv/addons/smart-home (github.com/Gathin23/cleanyourtv/tree/main/addo…)
• cleanyourtv/addons/tv-hub (github.com/Gathin23/cleanyourtv/tree/main/addo…)
• github.com/humblemuzzu/dumbtv — Take the ads, tracking and clutter out of your Fire TV over ADB, no root. Every step can be undone. Comes with its own open-source home screen.
• Amazon.com: Xiaomi TV Box S 3rd Gen (amazon.com/Xiaomi-TV-Box-3rd-Gen/dp/B0F3JWFL56)
• The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx (pretalx.seagl.org/2026/talk/HTMWCX)
• KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List (cybersecuritynews.com/linux-kernel-flaws-accid…)
• android-nixpkgs: Nix-packaged Android SDK (github.com/tadfisher/android-nixpkgs)
• LCARS - Wikipedia (en.wikipedia.org/wiki/LCARS)
• agent-shell - Emacs Agent Shell (github.com/xenodium/agent-shell) — Brings your favorite AI agents to Emacs, keeping you at home.
• HouseWaves (gethousewaves.com) — Home Assistant Whole-Home Multi-Room Speakers
• LeadStinger (github.com/weckere/leadstinger)
• Niri (github.com/niri-wm/niri) — A scrollable-tiling Wayland compositor.
• Umbriel (github.com/noctalia-dev/umbriel) — Umbriel is a Wayland compositor designed for daily use, with scrolling, dwindle, master, and floating layouts, per-output workspaces, window rules, blur, shadows, and fluid animations.
• NetBird - Open Source Zero Trust Networking (netbird.io)
• noblepayne/meshSidecar: Mesh network sidecars for NixOS Services (github.com/noblepayne/meshSidecar)
• Vero V - OSMC (osmc.tv/vero) — Vero V is OSMC’s fifth flagship streaming media player that’s designed for fast, “future-proof” 4K playback, including AV-1 and HDR formats. It uses an AMLogic S905X4 processor with 4GB RAM and 32GB eMMC storage, and it connects with HDMI 2.1, gigabit Ethernet, and Wi‑Fi.
• HelixNotes - GitLab (gitlab.com/ArkHost/HelixNotes) — A local, open-source Markdown note-taking app. No cloud, no account, no telemetry.
• Pick: Telescope (github.com/LunarKittyy/Telescope) — Use your phone's camera as a webcam on Linux or Windows, telephoto and wide lenses included.
• Telescope features.md - Telescope Docs (github.com/LunarKittyy/Telescope/blob/master/d…)
• Telescope: your phone as a webcam on Linux & Windows (telescope.webcam)
• Pick: plex2jellyfin (github.com/Nomadcxx/plex2jellyfin) — Migrate your Plex library to Jellyfin and keep it clean forever. Mass rename, dedupe, consolidate, then a daemon guards new downloads.