Podcasting 2.0 - Episode 276: "Jackleg leechers"

ShowNotes

-------------------------------------------------------------------------------------------------------------------------------------

00 - THE WEEK THE INDEX WENT DARK ON PURPOSE — PHP, NODE AND THE SCRAPERS

Tue 20 Oct, steven: "PHP 9.2 CVE" → php.net archive. Two critical unauthenticated RCEs (Castopod lists CVE-2026-109618 & -109619, PHP below 8.4.27).

Dave, 21 Oct 12:25 UTC: "Heads up, if Podcast Index api goes down at 9:00 am central time you'll know why." Then: "I've taken all the php servers offline until details come out."

16:07: "Podcast index api servers are patched and serving data again." 19:20: "After upgrading php-fpm… the fpm default config was in place so the api is running like a dawg. Restoring the pre-tuned settings now..." 20:19: "Fixed."

Dave on the pile-on: "Security people are unbearable… I know you'll be up all night patching PHP servers but there are also 27 CVE's in 5 other parts of your stack that are just as bad... or worse! Sure." (amended: "security influencers")

Then Node, 22 Oct: "Working on getting the web-ui repo upgraded because node.js blows worse than php. This day won't end." → "Done. Site is now on a current LTS node release and fully patched. Also blocked a large residential proxy scraper and a Chinese scraper bot in the process." → "Well, the site is down. I'm not a node guy…" (recovered). Adam: "Thank you Brother. This was a rough day for you."

web-ui PR #630: Harden outbound fetches to untrusted hosts (Node CVEs)

Others in the fire: Internet Archive ops (boosted by Dave) "used Claude to make fixes for our older php versions, used local models to run simulated attacks, deployed." Castopod 1.15.6 moved Docker to PHP 8.4.27. brianoflondon shut two MediaWiki sites.

And Dave's timing joke: someone shipped a release "on the same day as the global PHP panic? That's like someone choosing to release their indie film on the same day as Ghostbusters."

For Dave: what was in the scraper traffic, and is the API back to its pre-tuned numbers?

-------------------------------------------------------------------------------------------------------------------------------------

01 - ️ PNWR: THE PROFESSOR, LIQUID CONTENT, AND "SOMEBODY AS SMART AS ADAM CURRY" (2 clips)

Podnews Weekly Review, 23 Oct — "Podcasting is liquid content now" (1h36m). Guest: Steven Goldstein, CEO/founder of Amplify Media and NYU professor.

The open: Sam Sethi: "The Podcasting 2.0 and the Podcast Index, the Adam Curry and Dave Jones Project, is now six years old." James: "an awful