<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" encoding="UTF-8" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" xmlns:admin="http://webns.net/mvcb/" xmlns:atom="http://www.w3.org/2005/Atom/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:googleplay="http://www.google.com/schemas/play-podcasts/1.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd" xmlns:fireside="http://fireside.fm/modules/rss/fireside">
  <channel>
    <fireside:hostname>app02</fireside:hostname>
    <fireside:genDate>Thu, 05 Nov 2026 13:59:10 +0000</fireside:genDate>
    <generator>Fireside (https://fireside.fm)</generator>
    <title>LINUX Unplugged - Episodes Tagged with “Remote Code Execution”</title>
    <link>https://linuxunplugged.com/tags/remote%20code%20execution</link>
    <pubDate>Sun, 25 Oct 2026 13:45:00 -0700</pubDate>
    <description>An open show powered by community LINUX Unplugged takes the best attributes of open collaboration and turns it into a weekly show about Linux.</description>
    <language>en-us</language>
    <itunes:type>episodic</itunes:type>
    <itunes:subtitle>Weekly Linux talk show with no script, no limits, surprise guests and tons of opinion.</itunes:subtitle>
    <itunes:author>Jupiter Broadcasting</itunes:author>
    <itunes:summary>An open show powered by community LINUX Unplugged takes the best attributes of open collaboration and turns it into a weekly show about Linux.</itunes:summary>
    <itunes:image href="https://cdn.fireside.fm/file/fireside-images-2024/podcasts/images/f/f31a453c-fa15-491f-8618-3f71f1d565e5/cover.jpg?v=3"/>
    <itunes:explicit>no</itunes:explicit>
    <itunes:owner>
      <itunes:name>Jupiter Broadcasting</itunes:name>
      <itunes:email>chris@jupiterbroadcasting.com</itunes:email>
    </itunes:owner>
<itunes:category text="Technology"/>
<itunes:category text="News">
  <itunes:category text="Tech News"/>
</itunes:category>
<item>
  <title>690: The S in PHP is for Security</title>
  <link>https://linuxunplugged.com/690</link>
  <guid isPermaLink="false">001d7139-1aed-4d0f-9f38-91cbc11cda8b</guid>
  <pubDate>Sun, 25 Oct 2026 13:45:00 -0700</pubDate>
  <author>Jupiter Broadcasting</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/f31a453c-fa15-491f-8618-3f71f1d565e5/001d7139-1aed-4d0f-9f38-91cbc11cda8b.mp3" length="62105622" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Jupiter Broadcasting</itunes:author>
  <itunes:subtitle>A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.</itunes:subtitle>
  <itunes:duration>1:04:41</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://cdn.fireside.fm/file/fireside-images-2024/podcasts/images/f/f31a453c-fa15-491f-8618-3f71f1d565e5/cover.jpg?v=3"/>
  <description>&lt;p&gt;A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.&lt;/p&gt;</description>
  <itunes:keywords>Jupiter Broadcasting, Linux Podcast, Linux Unplugged, open source, self-hosted, plex2jellyfin, Telescope, LCARS, Android TV, dumbtv, CleanYourTV, Tailscale SSH, Nextcloud, memory safety, remote code execution, CVE-2026-109619, CVE-2026-109618, PHP, PHP2Shell, WordPress, Drupal, Joomla, OPcache, PHP-FPM, Minimax M3.1, Brotli, ksmbd, nginx, Rust, Nix Android SDK, ADB, Jellyfin, Plex, Jupiter Uplink, Clanker Therapy, stealmybitcoin.com, security, PHP security, use-after-free, memory corruption, CVE, vulnerability, security patch, memory exhaustion, web security, exploit, AI-assisted exploit, smart TV, debloat, Google TV, Fire TV, privacy, webcam, RTSP, IP camera, Seagl, agent-shell, HouseWaves, Home Assistant, quipclipper, leadstinger, Niri, Umbriel, NetBird, Vero V, OSMC, HelixNotes, note taking, scrolling window manager, RMS, We Are Brent</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://defined.net/unplugged">Nebula</a>: <a rel="nofollow" href="https://defined.net/unplugged">Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
</a></li><li><a rel="nofollow" href="https://incogni.com/unplugged">Incogni</a>: <a rel="nofollow" href="https://incogni.com/unplugged">They can't harm you if they can't find you! Take back control of your personal data today. Go to incogni.com/unplugged and use code UNPLUGGED for 60% off an annual plan. It's completely risk-free with a 30-day money-back guarantee.
</a> Promo Code: UNPLUGGED</li><li><a rel="nofollow" href="https://namecheap.promo">Namecheap</a>: <a rel="nofollow" href="https://namecheap.promo">Use code UNPLUGGED for an extra 15% off VPS hosting.
</a> Promo Code: UNPLUGGED</li></ul><p><a rel="payment" href="https://jupitersignal.memberful.com/checkout?plan=52946">Support LINUX Unplugged</a></p><p>Links:</p><ul><li><a title="Web Boost" rel="nofollow" href="https://boost.jupiterbroadcasting.com/?show=lup">Web Boost
</a> &mdash; Send us a boost via sats or USD
</li><li><a title="Jupiter Uplink" rel="nofollow" href="https://uplink.jupiterbroadcasting.com/">Jupiter Uplink
</a></li><li><a title="💥 Gets Sats Quick and Easy with Strike" rel="nofollow" href="https://strike.me/">💥 Gets Sats Quick and Easy with Strike
</a></li><li><a title="📻 LINUX Unplugged on Fountain.FM" rel="nofollow" href="https://www.fountain.fm/show/dWiuBeqpDSM86AwXRXov">📻 LINUX Unplugged on Fountain.FM
</a></li><li><a title="ConnecTen Internet: promo Jupiter35" rel="nofollow" href="https://connecteninternet.com/discount/Jupiter35">ConnecTen Internet: promo Jupiter35
</a></li><li><a title="MP3: Clanker Therapy 3: What Have You Been Building?" rel="nofollow" href="https://extras.show/95">MP3: Clanker Therapy 3: What Have You Been Building?
</a></li><li><a title="YouTube: Clanker Therapy 3: What Have You Been Building?" rel="nofollow" href="https://www.youtube.com/watch?v=Cyz-DeDXJbc">YouTube: Clanker Therapy 3: What Have You Been Building?
</a></li><li><a title="Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream" rel="nofollow" href="https://jupitersignal.memberful.com/posts/114789">Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream
</a></li><li><a title="PHP Security Release for PHP2Shell" rel="nofollow" href="https://www.php.net/index.php#2026-10-21-5">PHP Security Release for PHP2Shell
</a></li><li><a title="PHP2Shell: PHP Remote Code Execution" rel="nofollow" href="https://www.wiz.io/blog/php2shell-php-rce">PHP2Shell: PHP Remote Code Execution
</a></li><li><a title="Understanding PHP2Shell" rel="nofollow" href="https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know">Understanding PHP2Shell
</a></li><li><a title="CVE-2026-109618 - PHP RCE via OOM corruption" rel="nofollow" href="https://nvd.nist.gov/vuln/detail/cve-2026-109618">CVE-2026-109618 - PHP RCE via OOM corruption
</a></li><li><a title="CVE-2026-109619 - PHP RCE via stale global state" rel="nofollow" href="https://nvd.nist.gov/vuln/detail/cve-2026-109619">CVE-2026-109619 - PHP RCE via stale global state
</a></li><li><a title="Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers" rel="nofollow" href="https://cybersecuritynews.com/tailscale-ssh-flaws/">Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
</a></li><li><a title="PHP: OOM corruption advisory" rel="nofollow" href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w">PHP: OOM corruption advisory
</a></li><li><a title="PHP: stale global state advisory" rel="nofollow" href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp">PHP: stale global state advisory
</a></li><li><a title="PHP&#39;s October 23 follow-up" rel="nofollow" href="https://www.php.net/archive/2026.php#2026-10-23-1">PHP's October 23 follow-up
</a></li><li><a title="Steal My Bitcoin - a PHP RCE challenge!" rel="nofollow" href="https://stealmybitcoin.com/">Steal My Bitcoin - a PHP RCE challenge!
</a> &mdash; Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!+ <a href="https://news.ycombinator.com/item?id=50224916" target="_blank" rel="nofollow noopener">https://news.ycombinator.com/item?id=50224916</a>
</li><li><a title="People are using AI to make their smart TVs dumb again" rel="nofollow" href="https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again/">People are using AI to make their smart TVs dumb again
</a></li><li><a title="CleanYourTV" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv">CleanYourTV
</a> &mdash; Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home.
</li><li><a title="CleanYour.TV: remove ads and bloat from Android TV and Google TV" rel="nofollow" href="https://cleanyour.tv/">CleanYour.TV: remove ads and bloat from Android TV and Google TV
</a></li><li><a title="cleanyourtv/addons/frigate-glance" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv/tree/main/addons/frigate-glance">cleanyourtv/addons/frigate-glance
</a></li><li><a title="cleanyourtv/addons/smart-home" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv/tree/main/addons/smart-home">cleanyourtv/addons/smart-home
</a></li><li><a title="cleanyourtv/addons/tv-hub" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv/tree/main/addons/tv-hub">cleanyourtv/addons/tv-hub
</a></li><li><a title="humblemuzzu/dumbtv" rel="nofollow" href="https://github.com/humblemuzzu/dumbtv">humblemuzzu/dumbtv
</a> &mdash; Take the ads, tracking and clutter out of your Fire TV over ADB, no root. Every step can be undone. Comes with its own open-source home screen.
</li><li><a title="Amazon.com: Xiaomi TV Box S 3rd Gen" rel="nofollow" href="https://www.amazon.com/Xiaomi-TV-Box-3rd-Gen/dp/B0F3JWFL56">Amazon.com: Xiaomi TV Box S 3rd Gen
</a></li><li><a title="The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx" rel="nofollow" href="https://pretalx.seagl.org/2026/talk/HTMWCX/">The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx
</a></li><li><a title="KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List" rel="nofollow" href="https://cybersecuritynews.com/linux-kernel-flaws-accidentally-disclosed/">KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List
</a></li><li><a title="android-nixpkgs: Nix-packaged Android SDK" rel="nofollow" href="https://github.com/tadfisher/android-nixpkgs">android-nixpkgs: Nix-packaged Android SDK
</a></li><li><a title="LCARS - Wikipedia" rel="nofollow" href="https://en.wikipedia.org/wiki/LCARS">LCARS - Wikipedia
</a></li><li><a title="agent-shell - Emacs Agent Shell" rel="nofollow" href="https://github.com/xenodium/agent-shell">agent-shell - Emacs Agent Shell
</a> &mdash; Brings your favorite AI agents to Emacs, keeping you at home.
</li><li><a title="HouseWaves" rel="nofollow" href="https://gethousewaves.com/">HouseWaves
</a> &mdash; Home Assistant Whole-Home Multi-Room Speakers
</li><li><a title="LeadStinger" rel="nofollow" href="https://github.com/weckere/leadstinger">LeadStinger
</a></li><li><a title="Niri" rel="nofollow" href="https://github.com/niri-wm/niri">Niri
</a> &mdash; A scrollable-tiling Wayland compositor.
</li><li><a title="Umbriel" rel="nofollow" href="https://github.com/noctalia-dev/umbriel">Umbriel
</a> &mdash; Umbriel is a Wayland compositor designed for daily use, with scrolling, dwindle, master, and floating layouts, per-output workspaces, window rules, blur, shadows, and fluid animations.
</li><li><a title="NetBird - Open Source Zero Trust Networking" rel="nofollow" href="https://netbird.io/">NetBird - Open Source Zero Trust Networking
</a></li><li><a title="noblepayne/meshSidecar: Mesh network sidecars for NixOS Services" rel="nofollow" href="https://github.com/noblepayne/meshSidecar">noblepayne/meshSidecar: Mesh network sidecars for NixOS Services
</a></li><li><a title="Vero V - OSMC" rel="nofollow" href="https://osmc.tv/vero/">Vero V - OSMC
</a> &mdash; Vero V is OSMC’s fifth flagship streaming media player that’s designed for fast, “future-proof” 4K playback, including AV-1 and HDR formats. It uses an AMLogic S905X4 processor with 4GB RAM and 32GB eMMC storage, and it connects with HDMI 2.1, gigabit Ethernet, and Wi‑Fi.
</li><li><a title="HelixNotes - GitLab" rel="nofollow" href="https://gitlab.com/ArkHost/HelixNotes">HelixNotes - GitLab
</a> &mdash; A local, open-source Markdown note-taking app. No cloud, no account, no telemetry.
</li><li><a title="Pick: Telescope" rel="nofollow" href="https://github.com/LunarKittyy/Telescope">Pick: Telescope
</a> &mdash; Use your phone's camera as a webcam on Linux or Windows, telephoto and wide lenses included.
</li><li><a title="Telescope features.md - Telescope Docs" rel="nofollow" href="https://github.com/LunarKittyy/Telescope/blob/master/docs/features.md">Telescope features.md - Telescope Docs
</a></li><li><a title="Telescope: your phone as a webcam on Linux &amp; Windows" rel="nofollow" href="https://telescope.webcam/">Telescope: your phone as a webcam on Linux &amp; Windows
</a></li><li><a title="Pick: plex2jellyfin" rel="nofollow" href="https://github.com/Nomadcxx/plex2jellyfin">Pick: plex2jellyfin
</a> &mdash; Migrate your Plex library to Jellyfin and keep it clean forever. Mass rename, dedupe, consolidate, then a daemon guards new downloads.
</li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>A major PHP flaw puts servers everywhere at risk; so we hack ours. Meanwhile, open source helps debloat our smart TVs.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="https://defined.net/unplugged">Nebula</a>: <a rel="nofollow" href="https://defined.net/unplugged">Meet Managed Nebula from Defined Networking. A decentralized VPN built on the open-source Nebula platform that we love.
</a></li><li><a rel="nofollow" href="https://incogni.com/unplugged">Incogni</a>: <a rel="nofollow" href="https://incogni.com/unplugged">They can't harm you if they can't find you! Take back control of your personal data today. Go to incogni.com/unplugged and use code UNPLUGGED for 60% off an annual plan. It's completely risk-free with a 30-day money-back guarantee.
</a> Promo Code: UNPLUGGED</li><li><a rel="nofollow" href="https://namecheap.promo">Namecheap</a>: <a rel="nofollow" href="https://namecheap.promo">Use code UNPLUGGED for an extra 15% off VPS hosting.
</a> Promo Code: UNPLUGGED</li></ul><p><a rel="payment" href="https://jupitersignal.memberful.com/checkout?plan=52946">Support LINUX Unplugged</a></p><p>Links:</p><ul><li><a title="Web Boost" rel="nofollow" href="https://boost.jupiterbroadcasting.com/?show=lup">Web Boost
</a> &mdash; Send us a boost via sats or USD
</li><li><a title="Jupiter Uplink" rel="nofollow" href="https://uplink.jupiterbroadcasting.com/">Jupiter Uplink
</a></li><li><a title="💥 Gets Sats Quick and Easy with Strike" rel="nofollow" href="https://strike.me/">💥 Gets Sats Quick and Easy with Strike
</a></li><li><a title="📻 LINUX Unplugged on Fountain.FM" rel="nofollow" href="https://www.fountain.fm/show/dWiuBeqpDSM86AwXRXov">📻 LINUX Unplugged on Fountain.FM
</a></li><li><a title="ConnecTen Internet: promo Jupiter35" rel="nofollow" href="https://connecteninternet.com/discount/Jupiter35">ConnecTen Internet: promo Jupiter35
</a></li><li><a title="MP3: Clanker Therapy 3: What Have You Been Building?" rel="nofollow" href="https://extras.show/95">MP3: Clanker Therapy 3: What Have You Been Building?
</a></li><li><a title="YouTube: Clanker Therapy 3: What Have You Been Building?" rel="nofollow" href="https://www.youtube.com/watch?v=Cyz-DeDXJbc">YouTube: Clanker Therapy 3: What Have You Been Building?
</a></li><li><a title="Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream" rel="nofollow" href="https://jupitersignal.memberful.com/posts/114789">Bootleg: Clanker Therapy 3: What Have You Been Building? | Members Stream
</a></li><li><a title="PHP Security Release for PHP2Shell" rel="nofollow" href="https://www.php.net/index.php#2026-10-21-5">PHP Security Release for PHP2Shell
</a></li><li><a title="PHP2Shell: PHP Remote Code Execution" rel="nofollow" href="https://www.wiz.io/blog/php2shell-php-rce">PHP2Shell: PHP Remote Code Execution
</a></li><li><a title="Understanding PHP2Shell" rel="nofollow" href="https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know">Understanding PHP2Shell
</a></li><li><a title="CVE-2026-109618 - PHP RCE via OOM corruption" rel="nofollow" href="https://nvd.nist.gov/vuln/detail/cve-2026-109618">CVE-2026-109618 - PHP RCE via OOM corruption
</a></li><li><a title="CVE-2026-109619 - PHP RCE via stale global state" rel="nofollow" href="https://nvd.nist.gov/vuln/detail/cve-2026-109619">CVE-2026-109619 - PHP RCE via stale global state
</a></li><li><a title="Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers" rel="nofollow" href="https://cybersecuritynews.com/tailscale-ssh-flaws/">Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
</a></li><li><a title="PHP: OOM corruption advisory" rel="nofollow" href="https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w">PHP: OOM corruption advisory
</a></li><li><a title="PHP: stale global state advisory" rel="nofollow" href="https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp">PHP: stale global state advisory
</a></li><li><a title="PHP&#39;s October 23 follow-up" rel="nofollow" href="https://www.php.net/archive/2026.php#2026-10-23-1">PHP's October 23 follow-up
</a></li><li><a title="Steal My Bitcoin - a PHP RCE challenge!" rel="nofollow" href="https://stealmybitcoin.com/">Steal My Bitcoin - a PHP RCE challenge!
</a> &mdash; Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE we spent the last few days panicking over. Have fun!+ <a href="https://news.ycombinator.com/item?id=50224916" target="_blank" rel="nofollow noopener">https://news.ycombinator.com/item?id=50224916</a>
</li><li><a title="People are using AI to make their smart TVs dumb again" rel="nofollow" href="https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again/">People are using AI to make their smart TVs dumb again
</a></li><li><a title="CleanYourTV" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv">CleanYourTV
</a> &mdash; Debloat any Android or Google TV over Wi-Fi and get an Apple TV-style home.
</li><li><a title="CleanYour.TV: remove ads and bloat from Android TV and Google TV" rel="nofollow" href="https://cleanyour.tv/">CleanYour.TV: remove ads and bloat from Android TV and Google TV
</a></li><li><a title="cleanyourtv/addons/frigate-glance" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv/tree/main/addons/frigate-glance">cleanyourtv/addons/frigate-glance
</a></li><li><a title="cleanyourtv/addons/smart-home" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv/tree/main/addons/smart-home">cleanyourtv/addons/smart-home
</a></li><li><a title="cleanyourtv/addons/tv-hub" rel="nofollow" href="https://github.com/Gathin23/cleanyourtv/tree/main/addons/tv-hub">cleanyourtv/addons/tv-hub
</a></li><li><a title="humblemuzzu/dumbtv" rel="nofollow" href="https://github.com/humblemuzzu/dumbtv">humblemuzzu/dumbtv
</a> &mdash; Take the ads, tracking and clutter out of your Fire TV over ADB, no root. Every step can be undone. Comes with its own open-source home screen.
</li><li><a title="Amazon.com: Xiaomi TV Box S 3rd Gen" rel="nofollow" href="https://www.amazon.com/Xiaomi-TV-Box-3rd-Gen/dp/B0F3JWFL56">Amazon.com: Xiaomi TV Box S 3rd Gen
</a></li><li><a title="The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx" rel="nofollow" href="https://pretalx.seagl.org/2026/talk/HTMWCX/">The LLM-gen-AI Elephant in Our FOSS Room :: SeaGL 2026 :: pretalx
</a></li><li><a title="KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List" rel="nofollow" href="https://cybersecuritynews.com/linux-kernel-flaws-accidentally-disclosed/">KSMBD: Critical Unpatched Linux Kernel Flaws Accidentally Disclosed on Public List
</a></li><li><a title="android-nixpkgs: Nix-packaged Android SDK" rel="nofollow" href="https://github.com/tadfisher/android-nixpkgs">android-nixpkgs: Nix-packaged Android SDK
</a></li><li><a title="LCARS - Wikipedia" rel="nofollow" href="https://en.wikipedia.org/wiki/LCARS">LCARS - Wikipedia
</a></li><li><a title="agent-shell - Emacs Agent Shell" rel="nofollow" href="https://github.com/xenodium/agent-shell">agent-shell - Emacs Agent Shell
</a> &mdash; Brings your favorite AI agents to Emacs, keeping you at home.
</li><li><a title="HouseWaves" rel="nofollow" href="https://gethousewaves.com/">HouseWaves
</a> &mdash; Home Assistant Whole-Home Multi-Room Speakers
</li><li><a title="LeadStinger" rel="nofollow" href="https://github.com/weckere/leadstinger">LeadStinger
</a></li><li><a title="Niri" rel="nofollow" href="https://github.com/niri-wm/niri">Niri
</a> &mdash; A scrollable-tiling Wayland compositor.
</li><li><a title="Umbriel" rel="nofollow" href="https://github.com/noctalia-dev/umbriel">Umbriel
</a> &mdash; Umbriel is a Wayland compositor designed for daily use, with scrolling, dwindle, master, and floating layouts, per-output workspaces, window rules, blur, shadows, and fluid animations.
</li><li><a title="NetBird - Open Source Zero Trust Networking" rel="nofollow" href="https://netbird.io/">NetBird - Open Source Zero Trust Networking
</a></li><li><a title="noblepayne/meshSidecar: Mesh network sidecars for NixOS Services" rel="nofollow" href="https://github.com/noblepayne/meshSidecar">noblepayne/meshSidecar: Mesh network sidecars for NixOS Services
</a></li><li><a title="Vero V - OSMC" rel="nofollow" href="https://osmc.tv/vero/">Vero V - OSMC
</a> &mdash; Vero V is OSMC’s fifth flagship streaming media player that’s designed for fast, “future-proof” 4K playback, including AV-1 and HDR formats. It uses an AMLogic S905X4 processor with 4GB RAM and 32GB eMMC storage, and it connects with HDMI 2.1, gigabit Ethernet, and Wi‑Fi.
</li><li><a title="HelixNotes - GitLab" rel="nofollow" href="https://gitlab.com/ArkHost/HelixNotes">HelixNotes - GitLab
</a> &mdash; A local, open-source Markdown note-taking app. No cloud, no account, no telemetry.
</li><li><a title="Pick: Telescope" rel="nofollow" href="https://github.com/LunarKittyy/Telescope">Pick: Telescope
</a> &mdash; Use your phone's camera as a webcam on Linux or Windows, telephoto and wide lenses included.
</li><li><a title="Telescope features.md - Telescope Docs" rel="nofollow" href="https://github.com/LunarKittyy/Telescope/blob/master/docs/features.md">Telescope features.md - Telescope Docs
</a></li><li><a title="Telescope: your phone as a webcam on Linux &amp; Windows" rel="nofollow" href="https://telescope.webcam/">Telescope: your phone as a webcam on Linux &amp; Windows
</a></li><li><a title="Pick: plex2jellyfin" rel="nofollow" href="https://github.com/Nomadcxx/plex2jellyfin">Pick: plex2jellyfin
</a> &mdash; Migrate your Plex library to Jellyfin and keep it clean forever. Mass rename, dedupe, consolidate, then a daemon guards new downloads.
</li></ul>]]>
  </itunes:summary>
</item>
<item>
  <title>556: The xz Backdoor Exposed 🚨</title>
  <link>https://linuxunplugged.com/556</link>
  <guid isPermaLink="false">5b666786-1220-4fe6-9d6f-b6ef537a3fe3</guid>
  <pubDate>Sun, 31 Mar 2024 18:00:00 -0700</pubDate>
  <author>Jupiter Broadcasting</author>
  <enclosure url="https://aphid.fireside.fm/d/1437767933/f31a453c-fa15-491f-8618-3f71f1d565e5/5b666786-1220-4fe6-9d6f-b6ef537a3fe3.mp3" length="58846585" type="audio/mpeg"/>
  <itunes:episodeType>full</itunes:episodeType>
  <itunes:author>Jupiter Broadcasting</itunes:author>
  <itunes:subtitle>We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.</itunes:subtitle>
  <itunes:duration>1:10:03</itunes:duration>
  <itunes:explicit>no</itunes:explicit>
  <itunes:image href="https://cdn.fireside.fm/file/fireside-images-2024/podcasts/images/f/f31a453c-fa15-491f-8618-3f71f1d565e5/cover.jpg?v=3"/>
  <description>&lt;p&gt;We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.&lt;/p&gt;</description>
  <itunes:keywords>Jupiter Broadcasting, Linux Podcast, Linux Unplugged, xz, backdoor, remote code execution, OpenSSH, Debian, Fedora, Ubuntu, Kali Linux, Arch Linux, Gentoo, openSUSE, Alpine, NixOS, Jia Tan, trust model, burnout, systemd, transparency, open source, HUMINT, compression libraries,</itunes:keywords>
  <content:encoded>
    <![CDATA[<p>We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="http://tailscale.com/linuxunplugged">Tailscale</a>: <a rel="nofollow" href="http://tailscale.com/linuxunplugged">Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!
</a></li><li><a rel="nofollow" href="https://1password.com/unplugged">1Password Extended Access Management</a>: <a rel="nofollow" href="https://1password.com/unplugged">Secure every sign-in for every app on every device.
</a></li></ul><p><a rel="payment" href="https://jupitersignal.memberful.com/checkout?plan=52946">Support LINUX Unplugged</a></p><p>Links:</p><ul><li><a title="💥 Gets Sats Quick and Easy with Strike" rel="nofollow" href="https://strike.me/">💥 Gets Sats Quick and Easy with Strike
</a></li><li><a title="📻 LINUX Unplugged on Fountain.FM" rel="nofollow" href="https://www.fountain.fm/show/dWiuBeqpDSM86AwXRXov">📻 LINUX Unplugged on Fountain.FM
</a></li><li><a title="oss-security mailing list" rel="nofollow" href="https://www.openwall.com/lists/oss-security/2024/03/29/4">oss-security mailing list
</a> &mdash; Backdoor in upstream xz/liblzma leading to ssh server compromise.
</li><li><a title="Fedora Announcement" rel="nofollow" href="https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users">Fedora Announcement
</a></li><li><a title="Debian Announcement" rel="nofollow" href="https://security-tracker.debian.org/tracker/CVE-2024-3094">Debian Announcement
</a></li><li><a title="Ubuntu Announcement" rel="nofollow" href="https://discourse.ubuntu.com/t/xz-liblzma-security-update/43714">Ubuntu Announcement
</a></li><li><a title="Kali Linux Announcement" rel="nofollow" href="https://www.kali.org/blog/about-the-xz-backdoor/">Kali Linux Announcement
</a></li><li><a title="Arch Linux Announcement" rel="nofollow" href="https://archlinux.org/news/the-xz-package-has-been-backdoored/">Arch Linux Announcement
</a></li><li><a title="Gentoo Announcement" rel="nofollow" href="https://bugs.gentoo.org/928134">Gentoo Announcement
</a></li><li><a title="openSUSE Tumbleweeed Announcement" rel="nofollow" href="https://news.opensuse.org/2024/03/29/xz-backdoor/">openSUSE Tumbleweeed Announcement
</a></li><li><a title="NixOS Unstable Discussion" rel="nofollow" href="https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405">NixOS Unstable Discussion
</a></li><li><a title="Why does it take two weeks for NixOS to replace xz?" rel="nofollow" href="https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405/5">Why does it take two weeks for NixOS to replace xz?
</a></li><li><a title="Andres Freund on Mastodon" rel="nofollow" href="https://mastodon.social/@AndresFreundTec/112180406142695845">Andres Freund on Mastodon
</a> &mdash; I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc....
</li><li><a title="rwmj on Hacker News" rel="nofollow" href="https://news.ycombinator.com/item?id=39865810">rwmj on Hacker News
</a> &mdash; Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 &amp; 41 because of its "great new features"
</li><li><a title="A Microcosm of the interactions in Open Source projects" rel="nofollow" href="https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/">A Microcosm of the interactions in Open Source projects
</a> &mdash; Make no mistake. This is the way it works. It needs to change.
</li><li><a title="Devuan GNU/Linux on X" rel="nofollow" href="https://twitter.com/devuanorg/status/1774029432979653069?t=ASJqAbm5fVHDKeq7CLKqjw">Devuan GNU/Linux on X
</a> &mdash; Devuan is not affected by the latest vulnerability caused by systemd.
</li><li><a title="systemd PR: Dynamically load compression libraries" rel="nofollow" href="https://github.com/systemd/systemd/pull/31550#issuecomment-1972737923">systemd PR: Dynamically load compression libraries
</a></li><li><a title="Matteo Croce on X" rel="nofollow" href="https://twitter.com/teknoraver85/status/1774452847188312163">Matteo Croce on X
</a> &mdash; I'm the author of such PR. While I absolutely didn't know that libxz had a backdoor, I really think that libraries should be loaded on-demand when rarely used, hence my change :)
</li><li><a title="Ryan C. Gordon on X" rel="nofollow" href="https://twitter.com/icculus/status/1774310925035524333">Ryan C. Gordon on X
</a> &mdash; This is probably how the xz thing happened, right?
</li><li><a title="Jan Wildeboer on the Fediverse" rel="nofollow" href="https://social.wildeboer.net/@jwildeboer/112184074379919145">Jan Wildeboer on the Fediverse
</a> &mdash; Again the FOSS world has proven to be vigilant and proactive in finding bugs and backdoors, IMHO.
</li><li><a title="Unplugged Core Membership" rel="nofollow" href="https://unpluggedcore.com/">Unplugged Core Membership
</a></li><li><a title="TXLF is coming up! " rel="nofollow" href="https://2024.texaslinuxfest.org/">TXLF is coming up! 
</a> &mdash; April 12 - 13 in Austin, Texas.
</li><li><a title="LFNW coming up!" rel="nofollow" href="https://linuxfestnorthwest.org/">LFNW coming up!
</a> &mdash; April 26 - 28
</li><li><a title="Mobile Game Ads Are Boosting Podcast Follower Counts" rel="nofollow" href="https://www.bloomberg.com/news/newsletters/2024-03-28/mobile-game-ads-are-boosting-podcast-follower-counts">Mobile Game Ads Are Boosting Podcast Follower Counts
</a> &mdash; Wondery, iHeart and Lemonada Media are all using a non-public product from MowPod - which gives extra lives and game credits to gamers if they follow shows on Apple Podcasts from game apps.
</li><li><a title="MowPod&#39;s podcast promotion tools: tales from the bar" rel="nofollow" href="https://podnews.net/article/mowpod-promotion">MowPod's podcast promotion tools: tales from the bar
</a></li><li><a title="fortydeux&#39;s NixOS Configs" rel="nofollow" href="https://github.com/fortydeux/Fortydeux-NixOS-System-Flake/">fortydeux's NixOS Configs
</a></li><li><a title="Prism Launcher" rel="nofollow" href="https://prismlauncher.org/">Prism Launcher
</a> &mdash; An Open Source Minecraft launcher with the ability to manage multiple instances, accounts and mods.
</li><li><a title="World Backup Day — March 31st" rel="nofollow" href="https://www.worldbackupday.com/en/">World Backup Day — March 31st
</a> &mdash; One small accident or failure could destroy all the important stuff you care about.
</li><li><a title="Updating Our Fiddly Bits | LINUX Unplugged 494" rel="nofollow" href="https://www.jupiterbroadcasting.com/show/linux-unplugged/494/">Updating Our Fiddly Bits | LINUX Unplugged 494
</a></li></ul>]]>
  </content:encoded>
  <itunes:summary>
    <![CDATA[<p>We're breaking down the attack: how it works, how it was hidden, and why time was running out for the attacker.</p><p>Sponsored By:</p><ul><li><a rel="nofollow" href="http://tailscale.com/linuxunplugged">Tailscale</a>: <a rel="nofollow" href="http://tailscale.com/linuxunplugged">Tailscale is a programmable networking software that is private and secure by default - get it free on up to 100 devices!
</a></li><li><a rel="nofollow" href="https://1password.com/unplugged">1Password Extended Access Management</a>: <a rel="nofollow" href="https://1password.com/unplugged">Secure every sign-in for every app on every device.
</a></li></ul><p><a rel="payment" href="https://jupitersignal.memberful.com/checkout?plan=52946">Support LINUX Unplugged</a></p><p>Links:</p><ul><li><a title="💥 Gets Sats Quick and Easy with Strike" rel="nofollow" href="https://strike.me/">💥 Gets Sats Quick and Easy with Strike
</a></li><li><a title="📻 LINUX Unplugged on Fountain.FM" rel="nofollow" href="https://www.fountain.fm/show/dWiuBeqpDSM86AwXRXov">📻 LINUX Unplugged on Fountain.FM
</a></li><li><a title="oss-security mailing list" rel="nofollow" href="https://www.openwall.com/lists/oss-security/2024/03/29/4">oss-security mailing list
</a> &mdash; Backdoor in upstream xz/liblzma leading to ssh server compromise.
</li><li><a title="Fedora Announcement" rel="nofollow" href="https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users">Fedora Announcement
</a></li><li><a title="Debian Announcement" rel="nofollow" href="https://security-tracker.debian.org/tracker/CVE-2024-3094">Debian Announcement
</a></li><li><a title="Ubuntu Announcement" rel="nofollow" href="https://discourse.ubuntu.com/t/xz-liblzma-security-update/43714">Ubuntu Announcement
</a></li><li><a title="Kali Linux Announcement" rel="nofollow" href="https://www.kali.org/blog/about-the-xz-backdoor/">Kali Linux Announcement
</a></li><li><a title="Arch Linux Announcement" rel="nofollow" href="https://archlinux.org/news/the-xz-package-has-been-backdoored/">Arch Linux Announcement
</a></li><li><a title="Gentoo Announcement" rel="nofollow" href="https://bugs.gentoo.org/928134">Gentoo Announcement
</a></li><li><a title="openSUSE Tumbleweeed Announcement" rel="nofollow" href="https://news.opensuse.org/2024/03/29/xz-backdoor/">openSUSE Tumbleweeed Announcement
</a></li><li><a title="NixOS Unstable Discussion" rel="nofollow" href="https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405">NixOS Unstable Discussion
</a></li><li><a title="Why does it take two weeks for NixOS to replace xz?" rel="nofollow" href="https://discourse.nixos.org/t/cve-2024-3094-malicious-code-in-xz-5-6-0-and-5-6-1-tarballs/42405/5">Why does it take two weeks for NixOS to replace xz?
</a></li><li><a title="Andres Freund on Mastodon" rel="nofollow" href="https://mastodon.social/@AndresFreundTec/112180406142695845">Andres Freund on Mastodon
</a> &mdash; I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc....
</li><li><a title="rwmj on Hacker News" rel="nofollow" href="https://news.ycombinator.com/item?id=39865810">rwmj on Hacker News
</a> &mdash; Very annoying - the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 &amp; 41 because of its "great new features"
</li><li><a title="A Microcosm of the interactions in Open Source projects" rel="nofollow" href="https://robmensching.com/blog/posts/2024/03/30/a-microcosm-of-the-interactions-in-open-source-projects/">A Microcosm of the interactions in Open Source projects
</a> &mdash; Make no mistake. This is the way it works. It needs to change.
</li><li><a title="Devuan GNU/Linux on X" rel="nofollow" href="https://twitter.com/devuanorg/status/1774029432979653069?t=ASJqAbm5fVHDKeq7CLKqjw">Devuan GNU/Linux on X
</a> &mdash; Devuan is not affected by the latest vulnerability caused by systemd.
</li><li><a title="systemd PR: Dynamically load compression libraries" rel="nofollow" href="https://github.com/systemd/systemd/pull/31550#issuecomment-1972737923">systemd PR: Dynamically load compression libraries
</a></li><li><a title="Matteo Croce on X" rel="nofollow" href="https://twitter.com/teknoraver85/status/1774452847188312163">Matteo Croce on X
</a> &mdash; I'm the author of such PR. While I absolutely didn't know that libxz had a backdoor, I really think that libraries should be loaded on-demand when rarely used, hence my change :)
</li><li><a title="Ryan C. Gordon on X" rel="nofollow" href="https://twitter.com/icculus/status/1774310925035524333">Ryan C. Gordon on X
</a> &mdash; This is probably how the xz thing happened, right?
</li><li><a title="Jan Wildeboer on the Fediverse" rel="nofollow" href="https://social.wildeboer.net/@jwildeboer/112184074379919145">Jan Wildeboer on the Fediverse
</a> &mdash; Again the FOSS world has proven to be vigilant and proactive in finding bugs and backdoors, IMHO.
</li><li><a title="Unplugged Core Membership" rel="nofollow" href="https://unpluggedcore.com/">Unplugged Core Membership
</a></li><li><a title="TXLF is coming up! " rel="nofollow" href="https://2024.texaslinuxfest.org/">TXLF is coming up! 
</a> &mdash; April 12 - 13 in Austin, Texas.
</li><li><a title="LFNW coming up!" rel="nofollow" href="https://linuxfestnorthwest.org/">LFNW coming up!
</a> &mdash; April 26 - 28
</li><li><a title="Mobile Game Ads Are Boosting Podcast Follower Counts" rel="nofollow" href="https://www.bloomberg.com/news/newsletters/2024-03-28/mobile-game-ads-are-boosting-podcast-follower-counts">Mobile Game Ads Are Boosting Podcast Follower Counts
</a> &mdash; Wondery, iHeart and Lemonada Media are all using a non-public product from MowPod - which gives extra lives and game credits to gamers if they follow shows on Apple Podcasts from game apps.
</li><li><a title="MowPod&#39;s podcast promotion tools: tales from the bar" rel="nofollow" href="https://podnews.net/article/mowpod-promotion">MowPod's podcast promotion tools: tales from the bar
</a></li><li><a title="fortydeux&#39;s NixOS Configs" rel="nofollow" href="https://github.com/fortydeux/Fortydeux-NixOS-System-Flake/">fortydeux's NixOS Configs
</a></li><li><a title="Prism Launcher" rel="nofollow" href="https://prismlauncher.org/">Prism Launcher
</a> &mdash; An Open Source Minecraft launcher with the ability to manage multiple instances, accounts and mods.
</li><li><a title="World Backup Day — March 31st" rel="nofollow" href="https://www.worldbackupday.com/en/">World Backup Day — March 31st
</a> &mdash; One small accident or failure could destroy all the important stuff you care about.
</li><li><a title="Updating Our Fiddly Bits | LINUX Unplugged 494" rel="nofollow" href="https://www.jupiterbroadcasting.com/show/linux-unplugged/494/">Updating Our Fiddly Bits | LINUX Unplugged 494
</a></li></ul>]]>
  </itunes:summary>
</item>
  </channel>
</rss>
