Wes Payne
Co-host of LINUX Unplugged, the Jupiter Broadcasting show on Linux, open source, self-hosting and home lab tooling, with topics ranging from NixOS and Home Assi...
“It's really going to show us the long tail of C code that is out there that we rely on. That these were always there. And a lot of them are not like some crazy bugs that humans could never find. They're bugs that humans could find. We've just never been able to look.”
LINUX Unplugged · Hands-On Engineering Podcasts · October 2026
The hosts ran through a week of vulnerabilities in PHP, the Brotli compression library, Nginx and the Linux kernel's built-in SMB server. Payne's point is that AI-assisted scanning is surfacing old bugs that were always findable but that nobody had the time to look for.
Transcript
…tricky to find out. I think the default fast API stack in particular wasn't vulnerable. So it depends a lot on the specifics versus Node, they just ship it. And so you had to update Node because it was baked in. But we also saw some Nginx issues. And we saw a bunch of issues in your favorite KSMPD.
Oh, that's right. That was. Yes. Yes, of course, the kernel's built-in Samba server. Who would have thought?
So, in this sort of rising tide of vulnerabilities, it's not that we will only see these issues, right? Because you can have just errors in every type of program, but it's really going to show us the long tail of C code that is out there that we rely on. That these were always there. And a lot of them are not like some crazy bugs that humans could never find. They're bugs that humans could find. We've just never been able to look. If you stack
a bunch of certain edge cases together, you could find them.
And in this case, this code was flagged two years ago.
Oh, that is an interesting bit of this, yes.
More from LINUX Unplugged
