Stratechery's first sponsor buys a video studio; the twenty minutes to watch turn on PHP2Shell and a distrusted certificate authority
Two free Stratechery items: the weekly email that shows what its first sponsor's money bought, and the 98-minute first video episode, whose twenty-minute security stretch covers a PHP flaw the NSA flagged and a certificate authority three browsers dropped.
Two items landed in your Gmail queue overnight, both from Stratechery and both free. Lenny's Newsletter published nothing; its newest item is still Wednesday's Claude Duet episode 1.
Friday's email is the week in Stratechery's own words, and the item it leads with is the video episode that shipped the day before.
The week Stratechery started filming
"2026.43: A New Era" — This Week in Stratechery, Ben Thompson
Published October 24, 2026, 01:00 Shanghai. Weekly email. Free. 2
- The sponsorship reached the product. Stripe has been Stratechery's presenting sponsor since October 21, and this week's email opens with what the money bought 2. Sharp Tech is now recorded in person and on video, and subscribers get an extra audio episode every Sunday morning 23. The studio is in Ben Thompson's house in Wisconsin, and Andrew Sharp flies in to record 3.
- The first pick is a phone that wins as a tablet. John Gruber reviewed the iPhone Duo, and the email's one-line summary of it is worth keeping: "it's an iPad that fits in your pocket, and it's awesome at that; just don't expect a good phone" 2. Thompson and Gruber gave the phone a Dithering episode of its own 2.
- The third pick is a documentary. Andrew Sharp said on Sharp Tech last week that he had no interest in Nathan Fielder's Elizabeth Holmes film, You Can See Everything, then watched it and loved it. He wrote five spoiler-free notes for anyone still deciding, and five more for anyone who has seen it 2. He calls it the most effective document of the modern media environment he has watched 2.
The second pick, Netflix, is the one item here this digest has already done. Wednesday's quarter went out on October 22, built from Netflix's own shareholder letter.
What the email adds is a longer view: a share price down 40% over twelve months, and a split worth keeping.
The content problems can be fixed; growing the business while Meta and YouTube hold the engagement may be harder 2.
Inside the first video episode
"Sharp Tech on Video: Netflix Angst, the End of the Internet, and Meta's VR Glasses" — Sharp Tech, Ben Thompson and Andrew Sharp
- A third of the run goes to Netflix, and that ground is covered here already. The Netflix chapter starts at 4:50 and runs to 38:20, the longest stretch in the episode 5. The chapter's angle, what can be fixed against what cannot, is the one summarised above.
- The twenty minutes worth your time are 38:20 to 58:25, on the week's security news. The chapter is titled "The End of the Internet" 5. Its two live subjects are a PHP flaw the NSA calls PHP2Shell and a certificate authority that three browser makers stopped trusting.
PHP runs directly on web servers and is widely used enough that the NSA calls its flaws an environment ripe for exploitation 6. PHP2Shell lets an attacker take control of an affected server without prior access or authentication 6.
The flaws sit in PHP itself, not in the applications running on it, and PHP shipped its patch on October 21 6. The NSA's advice: inventory every internet-facing service on PHP, apply the vendor patches, and take a system offline where an immediate update is impractical 6.
A certificate authority is what tells a browser that a site is the site it claims to be. eMudhra, an Indian firm, issued those certificates to customers ranging from Infosys and TCS to India's income-tax portal 7.
Google, Apple and Microsoft stopped trusting its certificates this week, after a researcher found eight keys generated in April 2025 had been shortened by the company's own software and left weak 7. The flaw survived eighteen months and two rounds of audits, and eMudhra says its infrastructure was never compromised 7. The company is exiting the global certificate business, and its shares fell 40% in two days 7.
One more document sits in that middle stretch, and it is the strangest thing in the episode. Anthropic employees asked an internal model how the NIST elliptic-curve seeds were generated, a question the cryptography community had left open for twenty-five years 8.
Claude found the answer in under half an hour. The seeds came from a 1990s C library's random-number generator, seeded with a Unix timestamp; twenty-five years of rumour had pointed instead at a hash of a joke passphrase 8. That makes a deliberate backdoor in those curves much less plausible, and Anthropic is explicit that nobody needs to change anything as a result 8.
| Start | Chapter | Length |
|---|---|---|
| 0:00 | A Podcast Update | 4:50 5 |
| 4:50 | Netflix Angst | 33:30 5 |
| 38:20 | The End of the Internet | 20:05 5 |
| 58:25 | Meta's VR Glasses | 7:08 5 |
| 1:05:33 | Anthropic Alignment | 8:29 5 |
| 1:14:02 | Why Apple Has Retained "Siri" | 4:27 5 |
| 1:18:29 | Reading as an AI Bottleneck | 6:31 5 |
| 1:25:00 | Podcast-Listening Speeds | 3:45 5 |
| 1:28:45 | Olive Oil Recs | 2:05 5 |
| 1:30:50 | Follow Up on Sports Rights | 0:30 5 |
| 1:31:20 | You Can See Everything | 6:43 5 |
Where to start
Watch 38:20 to 58:25 if your company runs anything on PHP, because the NSA's advice applies to internet-facing systems whoever hosts them 6.
Watch it too if your product depends on a certificate authority. One compromised authority can impersonate any site, and devices that rarely update may keep trusting the broken certificates for years 7.
The Netflix hour is the stretch you can skip. This digest had the quarter on October 22, with the numbers in it.
Nothing about a Stratechery subscription changed this week. The ads run for subscribers too, and the price stays where it is for the length of the deal 3.
The queue refills when Stratechery posts again.
References
- 1Lenny's Newsletter feed
lennysnewsletter.com
- 22026.43: A New Era — Stratechery
stratechery.com
- 3Presented by Stripe — Stratechery
stratechery.com
- 4Sharp Tech on Video — Stratechery
stratechery.com
- 5Sharp Tech with Ben Thompson — YouTube
youtube.com
- 6
- 7
- 8Claude reveals ECDSA curve origins — Anthropic
anthropic.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.