The Signal

PHP is the invisible software that runs roughly seven in ten websites with a known server-side language, including most of WordPress. This week it got two critical flaws that let an attacker with no account run code on a server just by sending a crafted request, and the attempts went from thousands to millions in a day. You don't run PHP. The sites you log into do. Today: what happened, the honest calibration of what it means for a person who isn't a web host, and the two groups of listeners with real homework, including anyone with a small-business or hobby website.

This show has told you to turn on automatic updates more times than any other piece of advice, because the fix almost always exists before the attack. This week: the case where the update was the attack. Attackers got into a software company's servers, pointed its backup program at a malicious download, and the program installed it without asking, because that's what updates do. Today: how it happened, why it's rare, why the auto-update advice still stands, and the one upgrade to the rule: it matters whose updates you trust.

“Zero-click spyware spread through ads" is the kind of headline that makes people want to throw their phone in a lake. Today: what zero-click actually means, how this one worked (the ad decided whether you were a target before it did anything), who it was aimed at, why that is almost certainly not you, and the short list of things that matter if you ever might be. Calm, precise, no lake.

After a year of this show teaching people to spot fake bank texts, impostor calls, and the "install this app" trick, the phone is starting to help. Google announced defenses that read scam patterns in messages from strangers, check suspicious links before you open them, verify that a "bank" call really came from the bank, and stop malware from quietly forwarding your calls. Today: what each one actually does, where it falls short, the settings to flip tonight, and the rule that stays yours no matter how smart the phone gets.

Browser extensions, the small add-ons that block ads, save coupons, or unlock right-click, run inside the one program where your whole life passes through: your browser. Many can read every page you visit and everything you type on it. This fall researchers found a batch that had been good for years, built an audience, and then quietly turned, including some that were bought from their original developers. Today: why an extension is a far bigger decision than it looks, the business model that turns helpful tools into spyware, and the ten-minute cleanup that most people have never done.