PeerTube patched a serious SQL injection and then found out that someone had already been exploiting it in the wild. The flaw sat in the ActivityPub actor score calculation, so a malicious actor name could carry SQL straight into your database, and because everything on the fediverse talks to everything else it hopped from instance to instance like an old school worm, quietly installing a fake plugin called Google Analytics JS. Victor walks through the weekend he spent patching ten infected instances while sick in bed with a modem that had just died on him, what the attacker could and could not actually reach, and why PeerTube’s plugin system is the real problem sitting underneath all of it.

Find Victor: @[email protected]
Find Paige: @[email protected]