跪拜 Guibai
← All articles
GitHub · Open Source

Android TV Debloaters, PHP RCE PoCs, and DeepSeek's Inference Framework Lead GitHub's Daily Trending Chart

By miofly ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Two PHP PoCs in one trending list make default session.upload_progress config a practical pre-auth RCE risk, so PHP shops should treat default setups as attack surface. The TV and Nintendo recompilation entries show user demand for locked-down devices and native ports, which has legal and maintenance implications for the projects.

Summary

The daily GitHub trending list for 2026-10-23 ranks 20 open-source projects by 24-hour star growth. Gathin23/cleanyourtv leads with +5,341 stars; it uses ADB to strip ads and bloatware from Android TV/Google TV without root and installs an Apple TV-style launcher. Cloudflare's security-audit-skill follows with +2,939 stars, offering a six-stage machine-readable audit process for code agents. DeepSeek's DeepInfer is third at +2,226 stars, an offline inference framework for DeepSeek-V4.1-Flash with optimized operators and support for NVIDIA SM100 and Huawei Ascend 950.

Security is the other big theme. Two PHP session.upload_progress RCE projects sit at #9 and #15: one covers PHP 5.4-8.5 with five pre-auth attack chains, the other targets PHP 8.4.26 on Apache prefork mod_php. On the AI tooling side, Graphify turns a codebase into a queryable knowledge graph without vector storage, reylo type-checks imported .sql files at compile time, claude-howto is a visual Claude Code curriculum, and Anthropic published knowledge-work-plugins for business functions.

The tail of the list has an x86-64 assembly language with a 42 KB compiler, a project booting iOS 16.5's XNU kernel on Android phones, an EL2 hypervisor running macOS 27 on a Snapdragon laptop, two ad-free TV launchers, an iPhone LiDAR scanner that exports Three.js scenes, and two native Nintendo recompilation projects for Apple Silicon and Windows/Linux.

Takeaways
— cleanyourtv gained +5,341 stars in 24 hours and uses ADB to remove ads and preinstalled bloatware from Android TV/Google TV without root, then installs an Apple TV-like launcher.
— cloudflare/security-audit-skill gained +2,939 stars and defines a six-stage machine-readable security audit flow: reconnaissance, coverage-driven hunting, candidate validation, structured output, independent log verification, and target-neutral reporting.
— deepseek-ai/DeepInfer gained +2,226 stars and is an offline inference framework for DeepSeek-V4.1-Flash with optimized operators, parallel scheduling, and deterministic sampling on NVIDIA SM100 and Huawei Ascend 950.
— DietrichGebert/ponytail gained +1,917 stars and aims to make AI agents write less unnecessary code by thinking like a lazy senior developer; it has over 100,000 stars.
— Graphify-Labs/graphify gained +1,373 stars and converts codebases, docs, SQL schemas, config files, and PDFs into queryable knowledge graphs using local AST parsing, with no vector store, plus /graphify integration for Claude Code, Cursor, Codex, and Gemini CLI.
— pengchujin/aerial-tv gained +950 stars and is a tvOS-style launcher for domestic Android TV with an ad-free interface, wallpaper, screensaver, input switching, and one-command ADB install on Xiaomi and TCL sets.
— simbasjungles/free-my-tv gained +787 stars and replaces the Google TV, LG, or Samsung home screen with a 60 fps, lower-memory launcher that aggregates streaming apps, hourly recommendations, weather, crypto prices, and sunset-based theming.
— luongnv89/claude-howto gained +712 stars and is a visual, example-driven learning path for Claude Code covering commands, agents, hooks, skills, and MCP servers with copyable templates and interactive quizzes.
— ikow/php2shell-poc gained +695 stars and targets PHP session.upload_progress vulnerabilities CVE-2026-109618/109619 across PHP 5.4-8.5 with five pre-auth RCE attack chains.
— ly05010419/MacNativeGames gained +661 stars and ports the native ARM64 code of The Legend of Zelda: Tears of the Kingdom to Apple Silicon, with Metal 4 graphics reconstruction and system service emulation.
— colinhacks/reylo gained +616 stars and lets developers import .sql files directly in TypeScript with compile-time type inference for Postgres, MySQL, and SQLite, catching SQL syntax and column errors at build time.
— tek-sys-hub/Rubix-lang gained +610 stars and is a system programming language written in pure x86-64 assembly with a 42 KB compiler producing libc-free Linux ELF64 and Windows PE64 binaries.
— php/php-src gained +514 stars and is the PHP interpreter source code implementing parsing, execution, and extension mechanisms.
— supabase/supabase gained +510 stars and provides hosted Postgres, auth, auto-generated REST/GraphQL/realtime APIs, Edge and database functions, file storage, AI/vector tooling, and a dashboard.
— 9bie/php2shell-bypass-aslr-exp gained +486 stars and is a Python PoC for PHP 8.4.26 on Apache prefork mod_php that achieves RCE from heap leak to system calls using only HTTP requests and a Docker image.
— wesbos/3d-model-anything gained +461 stars and is an iPhone LiDAR indoor scanner that exports room geometry and photos as editable Three.js scenes for AI coding agents to measure, model, and compare.
— oosexgang/hackios-xnu-kernel gained +460 stars and uses a custom EFI loader and drivers to boot Apple's open-source XNU kernel (iOS 16.5) on Android phones or QEMU, running unmodified iOS 16.5 userspace.
— Acelogic/Snapintosh gained +451 stars and is an experimental EL2 hypervisor/toolchain that runs macOS 27 on an ASUS Zenbook A16 with Snapdragon X2 Elite, including Adreno X2 Metal graphics, keyboard, trackpad, Wi-Fi, and NVMe.
— anthropics/knowledge-work-plugins gained +443 stars and packages Claude plugins for productivity, sales, support, product management, marketing, legal, finance, data, enterprise search, and biology, with Slack, Notion, and Jira automation.
— Revivedx/SavageWindRecomp gained +441 stars and is a static recompilation of The Legend of Zelda: Breath of the Wild 1.8.2 to Windows/Linux native executables, currently running at 60 fps in the Great Plateau opening area with mod support planned.
Conclusions

Two independent PHP session.upload_progress PoCs landed in the same 20-project window, one spanning PHP 5.4-8.5 and one aimed at PHP 8.4.26. Default PHP deployments are a broad attack surface, and the exploit chains are now packaged for reuse.

DeepInfer's support for Huawei Ascend 950 alongside NVIDIA SM100 puts domestic accelerators on the same footing as mainstream GPUs for inference, which matters for anyone deploying DeepSeek models in China.

Three TV projects reached the list on the same day, all promising an ad-free home screen. The repeated pitch shows default TV interfaces have become a mainstream annoyance.

SavageWindRecomp explicitly requires users to obtain and export game files legally, and MacNativeGames expects XCI/NSP files plus prod.keys. That legal framing is what lets native recompilation projects stay public while still shipping working ports.

Concepts & terms
ADB (Android Debug Bridge)
A command-line tool from Android's platform tools that lets you communicate with a device over USB or network. The TV tools use ADB to uninstall packages and install launchers without root.
RCE (Remote Code Execution)
An attack that lets a remote attacker run arbitrary code on a target machine. The PHP PoCs aim for pre-auth RCE, meaning no login is required.
Knowledge graph
A structured network of entities and relationships. Graphify builds one from a codebase so queries can span code, docs, schemas, and configs without a vector database.
EL2 hypervisor
A low-level virtualization layer on ARM systems, below the operating system, that can create and control virtual machines. Snapintosh uses it to run macOS 27 on Snapdragon hardware.
Static recompilation
Translating a program from one platform to another without executing it, producing a native binary. SavageWindRecomp applies this to a Nintendo Switch game to create PC executables.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗