https://video.fedihost.co/videos/watch/360875e3-7d14-410a-9e6a-d5d1e01f2486 PeerTube patched a serious SQL injection and then found out that someone had already been exploiting it in the wild. The flaw sat in the ActivityPub actor score calculation, so a malicious actor name could carry SQL straight into your database, and because everything on the fediverse talks to everything else it hopped from instance to instance like an old school worm, quietly installing a fake plugin called Google Analytics JS. Victor walks through the weekend he spent patching ten infected instances while sick in bed with a modem that had just died on him, what the attacker could and could not actually reach, and why PeerTube's plugin system is the real problem sitting underneath all of it. Find Victor: @kini@maro.xyz Find Paige: @paige@canadiancivil.com Tue, 04 Aug 2026 19:01:56 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://video.fedihost.co https://video.fedihost.co/lazy-static/avatars/c7aa8df8-26ae-4494-9eb9-eda46cfe0e5b.png https://video.fedihost.co/videos/watch/360875e3-7d14-410a-9e6a-d5d1e01f2486 All rights reserved, unless otherwise specified in the terms specified at https://video.fedihost.co/about and potential licenses granted by each content's rightholder.