This PHP vulnerability is a big deal

Audio is streamed directly from the publisher (api.riverside.com) as published in their RSS feed. Play Podcasts does not host this file. Rights-holders can request removal through the copyright & takedown page.