690: The S in PHP is for Security

A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.

Sponsored By:

• Managed Nebula: Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
• Incogni: They can't harm you if they can't find you! Take back control of your personal data today. Go to incogni.com/unplugged and use code unplugged for 60% off an annual plan. It's completely risk-free with a 30-day money-back guarantee.
• Namecheap: Use code UNPLUGGED for an extra 15% off VPS hosting.

Support LINUX Unplugged

Links:

• Web Boost — Send us a boost via sats or USD
• Jupiter Uplink
• 💥 Gets Sats Quick and Easy with Strike
• 📻 LINUX Unplugged on Fountain.FM
• ConnecTen Internet: promo Jupiter35
• MP3: Clanker Therapy 3: What Have You Been Building?
• YouTube: Clanker Therapy 3: What Have You Been Building?
• Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream
• PHP Security Release for PHP2Shell
• PHP2Shell: PHP Remote Code Execution
• Understanding PHP2Shell
• CVE-2026-109618 - PHP RCE via OOM corruption
• CVE-2026-109619 - PHP RCE via stale global state
• Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
• PHP: OOM corruption advisory
• PHP: stale global state advisory
• PHP's October 23 follow-up
• Steal My Bitcoin - a PHP RCE challenge! — Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!+ https://news.ycombinator.com/item?id=50224916
• People are using AI to make their smart TVs dumb again
• CleanYourTV — Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home.
• CleanYour.TV: remove ads and bloat from Android TV and Google TV
• cleanyourtv/addons/frigate-glance
• cleanyourtv/addons/smart-home
• cleanyourtv/addons/tv-hub
• humblemuzzu/dumbtv — Take the ads, tracking and clutter out of your Fire TV over ADB, no root. Every step can be undone. Comes with its own open-source home screen.
• Amazon.com: Xiaomi TV Box S 3rd Gen
• The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx
• KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List
• android-nixpkgs: Nix-packaged Android SDK
• LCARS - Wikipedia
• agent-shell - Emacs Agent Shell — Brings your favorite AI agents to Emacs, keeping you at home.
• HouseWaves — Home Assistant Whole-Home Multi-Room Speakers
• LeadStinger
• Niri — A scrollable-tiling Wayland compositor.
• Umbriel — Umbriel is a Wayland compositor designed for daily use, with scrolling, dwindle, master, and floating layouts, per-output workspaces, window rules, blur, shadows, and fluid animations.
• NetBird - Open Source Zero Trust Networking
• noblepayne/meshSidecar: Mesh network sidecars for NixOS Services
• Vero V - OSMC — Vero V is OSMC’s fifth flagship streaming media player that’s designed for fast, “future-proof” 4K playback, including AV-1 and HDR formats. It uses an AMLogic S905X4 processor with 4GB RAM and 32GB eMMC storage, and it connects with HDMI 2.1, gigabit Ethernet, and Wi‑Fi.
• HelixNotes - GitLab — A local, open-source Markdown note-taking app. No cloud, no account, no telemetry.
• Pick: Telescope — Use your phone's camera as a webcam on Linux or Windows, telephoto and wide lenses included.
• Telescope features.md - Telescope Docs
• Telescope: your phone as a webcam on Linux & Windows
• Pick: plex2jellyfin — Migrate your Plex library to Jellyfin and keep it clean forever. Mass rename, dedupe, consolidate, then a daemon guards new downloads.