ShowNotes
-------------------------------------------------------------------------------------------------------------------------------------
00 - THE WEEK THE INDEX WENT DARK ON PURPOSE — PHP, NODE AND THE SCRAPERS
Tue 20 Oct, steven: "PHP 9.2 CVE" → php.net archive. Two critical unauthenticated RCEs (Castopod lists CVE-2026-109618 & -109619, PHP below 8.4.27).
Dave, 21 Oct 12:25 UTC: "Heads up, if Podcast Index api goes down at 9:00 am central time you'll know why." Then: "I've taken all the php servers offline until details come out."
16:07: "Podcast index api servers are patched and serving data again." 19:20: "After upgrading php-fpm… the fpm default config was in place so the api is running like a dawg. Restoring the pre-tuned settings now..." 20:19: "Fixed."
Dave on the pile-on: "Security people are unbearable… I know you'll be up all night patching PHP servers but there are also 27 CVE's in 5 other parts of your stack that are just as bad... or worse! Sure." (amended: "security influencers")
Then Node, 22 Oct: "Working on getting the web-ui repo upgraded because node.js blows worse than php. This day won't end." → "Done. Site is now on a current LTS node release and fully patched. Also blocked a large residential proxy scraper and a Chinese scraper bot in the process." → "Well, the site is down. I'm not a node guy…" (recovered). Adam: "Thank you Brother. This was a rough day for you."
web-ui PR #630: Harden outbound fetches to untrusted hosts (Node CVEs)
Others in the fire: Internet Archive ops (boosted by Dave) "used Claude to make fixes for our older php versions, used local models to run simulated attacks, deployed." Castopod 1.15.6 moved Docker to PHP 8.4.27. brianoflondon shut two MediaWiki sites.
And Dave's timing joke: someone shipped a release "on the same day as the global PHP panic? That's like someone choosing to release their indie film on the same day as Ghostbusters."
For Dave: what was in the scraper traffic, and is the API back to its pre-tuned numbers?
-------------------------------------------------------------------------------------------------------------------------------------
01 - ️ PNWR: THE PROFESSOR, LIQUID CONTENT, AND "SOMEBODY AS SMART AS ADAM CURRY" (2 clips)
Podnews Weekly Review, 23 Oct — "Podcasting is liquid content now" (1h36m). Guest: Steven Goldstein, CEO/founder of Amplify Media and NYU professor.
The open: Sam Sethi: "The Podcasting 2.0 and the Podcast Index, the Adam Curry and Dave Jones Project, is now six years old." James: "an awful lot of hard work going on with Dave Jones at the moment to make it easier for anybody to keep it updated."
Liquid content, per Goldstein: not his term (Matthew Loran, Google DeepMind), but he brought it to podcasting: "why does content have to be in one place when people are now consuming in multiple places in multiple ways?" His model is the New York Times: print to ~400K, The Daily audio to 2–3M a day.
CLIP 1 — Sam Sethi - Adam Curry Vibe Codes His Own Podcast App, Is That The Future - POD NEWS WEEKLY REVIEW (0:58)
CLIP 2 — Steven Goldstein - The Robot's Getting Smarter, Ten Years Out - POD NEWS WEEKLY REVIEW (1:47)
Adam's answer is already on the record, 19 Oct: "While I am indeed not a 'normal' person, I vibe coded this app with one prompt and 19 followups for bugs or changes." And: "Sooner than even I expected" — Google Play now supports private vibe-coded apps built for one person.
TechCrunch: Google Play now supports private vibe-coded apps built just for you
The "normal person" who already did it (PNWR listener mail, 87:06): Claire Waite Brown had her husband build her own show-notes/titles/clips platform with AI a year ago, with a spelling dictionary. James: "it relates back to what Adam said… you don't need external platforms to do this." Then: "Dave was talking about normies, and Adam was getting upset about people talking about normies."
Pushback from our side: ChadF: "I haven't seen a great vibecoded 2.0 app yet and that includes my own stuff b/c they are extremely hard to make." Dave: "Give the listener control of the entire experience. Let their agents customize the whole experience."
Adam to aegrumet, 22 Oct: his Muse app gets new recommendations through the day, "based on lots of parameters, including where I am physically… It has become exciting to see what pops up vs a 'new' indicator in a mailbox." And 20 Oct: "Why would you want to be in the middle of the dream/build loop?"
Also on PNWR: Spotify paid podcast memberships (34 markets, 10% cut, bought on the web, not in-app) · Substack tests dynamic ad insertion · Netflix podcasts ("revenues up 12%, that's not failing") · Castos launches UltraClip · Podgagement's Networking Radar.
-------------------------------------------------------------------------------------------------------------------------------------
02 - EVERYBODY HAS AN MCP NOW
Sam Sethi to Adam and Dave: "TrueFans MCP connector will be ready by the end of the month. We already have a test version working internally… Kevin & Kelly prototypes to let users ask questions." ("This was a boost that never got read or seen. ;-(")
show.fm (danmaby): developer docs updated for the new API and "the read-only MCP".
Sam Sethi is testing WebMCP — Google and Microsoft's proposed standard that lets a web page expose tools directly to a browser AI agent in the same tab.
Dave Hamilton (Business Brain 799, "Agents talking to Agents"): had Claude build an MCP connector for his company's backend in about 30 minutes; "When your customer's AI agent hits a roadblock… it simply goes somewhere else."
billynewman: a 220-degree immersive Oregon film cut and rendered by "KINOCUT MCP for ffmpeg", with a V4V support interface under the theater.
JS: people are vibe-coding their smart TVs "to get rid of sponsored ads, speed up the app launcher… disable tracking features."
mikek999's topic suggestion: AI prompt injection (YouTube example).
-------------------------------------------------------------------------------------------------------------------------------------
