The front door
Four ways to reach the server from outside, and the two settings that decide whether the proxy is trusted.
~ / articles
The archive
Every published piece, newest first. Search titles, subjects and summaries. Every story is in this page before any filtering runs.
190 entries9 sectionsnewest first
summarylive
190 stories — newest first
No stories match these filters.
entries40 of 190
4 stories
10 min read
Before you buy a GPU
Most stutters are a client asking for something the server cannot send. The dashboard tells you which, and the fix is often smaller than a graphics card.
The finishing pass: plugins, metadata and subtitles
The scan gets a library working. What makes it feel owned is the poster, the match, and knowing which two plugins are worth the restart.
Jellyfin in an evening
What Jellyfin does that a streaming subscription does not, how a household actually uses it, and the install that gets a library playing tonight. The first part of a series.
2 stories
nspawn 3.x serves a Docker socket on the host, and it hands out root
nspawn 3.0.0 puts a Docker Engine API on the host at /run/nspawn/api.sock, so tools that speak Docker can manage systemd-nspawn machines, and 3.2.1 adds arm64 packages marked experimental. The socket ships off and takes two commands to enable, an optional drop-in answers on /run/docker.sock, and the project warns that any user with org.nspawn.manage is root on the host.
PyPI's new Security tab says where a release came from, and that is not a verdict
PyPI's redesigned project pages went live on 6 November with a Security tab that reports a release's provenance: full, none, incomplete, inconsistent, changed or lost. The post is explicit that no provenance does not mean malicious, that it means the file origin cannot be cryptographically verified, and that the states worth checking before you install are the warnings.
1 story
Immich is worth the evening
What Immich does that the cloud does not, how you use it once it is running, and the install that keeps it running. One evening of setup, then a photo library you own.
2 stories
Immich, PhotoPrism or Ente: which photo library to run
Immich is the pick for most self-hosters. It is the only one of the three with official mobile apps, it searches on the server, it speaks OIDC and its backup covers the database, at a documented 6 GB minimum and an x86-64-v2 requirement that stops older hardware cold. PhotoPrism is the smaller install at 3 GB, with a PWA instead of an app. Ente is the only one where the server never holds a plaintext photo, which is why self-hosting it means building your own apps.
Readeck saves the page, not the link
Readeck stores the readable content of a web page rather than a bookmark pointing at it, which is the whole pitch and the reason to run it. It ships as one executable, runs happily on 512 MB and a forgotten Raspberry Pi 2, and installs from a single docker run or a short compose file with one volume holding database and bookmarks. This profile covers the documented install path, the settings that matter behind a proxy, the export and import commands, and the limits the documentation states.
1 story
PwnEscape Part 2: from a Firecracker guest to root on the host, in a setup without the jailer
The researchers behind October's kernel bug have published the other half: using that host-memory primitive to find Firecracker in memory, take over a live vCPU thread and redirect its return from KVM to a call of their choosing, with the VM left running and reachable. Their test used Firecracker v1.16.1 with the VMM launched as root and no jailer, and they say a jailer-hardened deployment needs a separate assessment. No new CVE, no vendor advisory and no Firecracker fix appears in the source.
3 stories
Alpine's sshd could be logged into without a password, and the upgrade alone does not close it
Alpine's advisory of 5 November describes a password authentication bypass in sshd built without PAM on musl: an attacker who can reach the SSH port logs in with a very long password as an account whose password field is *, provided another account on the machine has a $5$ or $6$ hash. Upstream OpenSSH 10.6p2 calls it a critical security workaround and puts the root cause outside sshd. Alpine's fixed packages run from edge 10.6_p2-r0 back to 3.16 9.0_p1-r6, the upgrade is not complete until sshd is restarted, and no CVE had been assigned.
SourceHut's closed registration was closed in the page, not in the handler
meta.sr.ht before 0.89.0 still accepted POST /register/step2 on instances whose operator had disabled registration: the handler returned the closed message on every error path but did not check the setting on the success path, and a CSRF token lifted from /login made the request work. Email confirmation still applied where SMTP was configured. NVD scores it 5.3 Medium on its primary CVSS 3.1 metric and fixes 0.89.0, and nothing collected shows exploitation.
zlib 1.4 fixes an 8 MB overwrite and a miniunz that could leave the extraction directory
zlib 1.4, with notes dated 4 November 2026 and published the next day, carries a buffer overflow in non-blocking gzwrite() (CVE-2026-85091), an inflateGetDictionary() overwrite of up to 8 MB past a caller's 32K buffer affecting 1.3.1 and 1.3.2, and minizip fixes including a miniunz that could create directories outside the extraction directory. CVE-2026-4738 in contrib/infback9 comes with the project's own caveat that the critical rating overstates it, and builders face a CMake 3.15 minimum plus libz naming on MSVC and Cygwin. The project's notes are the only source collected here, so no CVSS score is quoted.
2 stories
Debian's apt can be tricked into swapping a package after it has been verified
DSA-6607-1 fixes CVE-2026-109518, found by Max Justicz: an HTTP redirect can leave two package downloads sharing a URI, and resume handling then lets a man-in-the-middle replace a package after verification, running code as root. Debian's tracker lists trixie fixed at 3.0.4 and bookworm at 2.6.2, with forky and sid at 3.3.5 in the package table and 3.3.6 listed only in the fixed-versions table. The same update also addresses out-of-bounds access issues in apt, and neither document carries a severity score.
Two Critical Puppet bugs are fixed, and your autosign config decides how exposed you were
CVE-2026-115731 (CVSS 4.0 9.4) lets anyone holding a CA-signed agent certificate run code on the Puppet Server by submitting a crafted report, and autosign without strong verification turns that into an unauthenticated chain. CVE-2026-115732 (9.0) accepts a certificate whose name extends or shortens an authorised hostname as that host. OpenVox patched on 3 November with server 9.2.0 and 8.18.0 and agent 9.3.0 and 8.32.0; the NVD records carry Perforce's Puppet Enterprise ranges, and nothing collected shows exploitation in the wild.
1 story
Forgejo drops OpenID 2.0 in v19, and your deadline depends on your release track
A Forgejo notice dated 2 November 2026 says OpenID Authentication 2.0 support ends in v19, scheduled for 25 March 2027, with v15 LTS the last release to carry it on the LTS track and v17 and v18 on the stable track. The notice also says OIDC and OAuth are unaffected, gives no CVE or security reason, and sends readers to a discussion thread for the reasoning. No configuration keys or setup steps were collected for this note.
2 stories
Ubuntu has CVE-2026-98432 fixes for 22.04 and newer, but only in -proposed
Ubuntu's status post puts the CVE-2026-98432 kernel fixes in the -proposed pocket for 22.04, 24.04 and 26.04, with 26.10 already fixed in 7.3.0-10.10, 16.04 through 20.04 still pending, and 14.04 listed as not affected. The post also says plainly that mitigations disabling multipath TCP are not the fix, because the flaw is not specific to MPTCP, and it documents the opt-in install path with the warning that -proposed packages are not upgraded by default.
Vaultwarden 1.37.5 fixes two private advisories, and its config check now refuses to start
Vaultwarden 1.37.5 carries fixes for two Medium advisories, website icons at 5.3 and emergency access at 4.3, both still private pending CVE assignment and publication. The upgrade note that matters most is configuration: invalid values now stop startup with an error rather than being tolerated, the bundled web vault moves to v2026.10.1, and self-served vaults older than v2026.7.1 may have compatibility problems.
2 stories
Homebridge 2.5.0 is a Matter release: new device types, and fixes for identity and cache
Homebridge 2.5.0 adds Matter device types for solar, battery, EV chargers, meters, tariffs and water heaters, and spends the rest of its list on behaviour that used to go wrong: air quality reporting only two levels, thermostats registering late, restored accessories losing their uniqueId or owner, and cache reads that took the accessory with them. It also bumps @matter/main to v0.18.0 and @homebridge/hap-nodejs to v2.3.0.
Let's Encrypt moves to 64-day certificates in February, and renewal maths has to move with it
From 10 February 2027 Let's Encrypt issues 64-day certificates by default, with the last 90-day certificate expiring on 11 May 2027 and no revocation of what is already out there. Clients that follow ACME Renewal Info handle it; hard-coded offsets need to move to about two thirds of the lifetime, and a third-party test in October found one acme.sh version scheduling its renewal after the certificate had already expired.
3 stories
Mealie 3.30.0 lets you own the AI prompt, time each step, and plan a whole week
Mealie 3.30.0 moves AI prompt control into the app, so prompts can be appended to, replaced or extended with global instructions, and it retires the OPENAI_CUSTOM_PROMPT_DIR variable while importing existing prompts automatically. Instruction steps gain individual durations, meal plan entries can cover a full week, and a batch of fixes tightens import scoping, locale lookup and the permissions needed to manage units, tools, labels and recipe actions.
Memos 26.10.0 signs API clients out, stops reading /etc/secrets and makes export an admin job
Memos 26.10.0 is the first release under calendar versioning, and its upgrade notes matter more than its features: old installs need a 0.31.0 waypoint, cached access tokens expire on upgrade, the /etc/secrets files from 0.31.0 are no longer read, member export disappears, and the old upload and memo-length settings are replaced without migration. The features are a rich editor by default, per-user usage limits and declarative configuration.
The restore runbook: bring a service back in the right order
After a host dies, the order of the recovery decides whether it works. The secrets come first, then the data and the database dump, DNS last, and one check that proves the service is actually back.
2 stories
The official Claude Code extension bundle on the Cursor Marketplace carried an SSH backdoor
Phorion reports a backdoor in the Claude Code for VS Code extension bundle distributed through the Cursor Marketplace, which planted an SSH key, opened a reverse tunnel and installed persistence on macOS, Linux and Windows. Cursor pulled version 2.1.313 from its marketplace and the NPM and VS Code registries. The advisory lists the bundle hash, two key fingerprints and the tunnel server, and a macOS bug blunts the inbound path without removing the persistence.
CVE-2026-98432 is a Linux TCP use-after-free, and Anthropic's model reached root with it
CVE-2026-98432 is a race in the Linux kernel's handling of IPv4 TCP options, where a retransmitted SYN can free a structure another thread is still reading. The record carries a 9.8 critical CVSS v3.1 vector and stable backports, and Anthropic's write-up names it as the kernel bug behind a zero-click chain that reached a root shell on servers with a multipath TCP listener.
2 stories
borgmatic 2.2.0 keeps Borg deduplicating the tarballs you back up
borgmatic 2.2.0 adds a beta tarballs data source that streams a tar file into Borg as individual files, so VM exports deduplicate instead of sitting in the archive as one packed blob. The release also fixes a hang that hit database dumps with heavy output, file-descriptor exhaustion when dumping hundreds of databases, and a regression that cost ZFS, LVM and Btrfs hooks their Borg cache hits.
Paperless-ngx 3.4.0 builds workflow titles from custom fields and hands thumbnails to poppler
Paperless-ngx 3.4.0 lets workflow title templates use custom fields, adds relative date queries, and generates PDF thumbnails through poppler in the release that drops ImageMagick from the dependency list. Local 2FA is now skipped when an OIDC login carries a trusted AMR claim, and a set of quiet fixes covers re-index ordering, folder exports with --delete, and revoked task results.
1 story
Tailscale's SSH bugs sat after authorisation, and it rejects the worm label
Tailscale shipped v1.104.4 on 28 October with fixes for privilege-boundary bugs in Tailscale SSH and three Serve bugs. The flaws were about what a session could do after it was authorised, not who could connect, and Tailscale argues the 'Tailworm' framing overstates them: exploitation needs an existing foothold in the tailnet and SSH permitted by policy.
1 story
Grafana lists ten CVEs in 13.3.0 and fixes an eleventh
Grafana shipped 12.4.14, 13.2.5 and 13.3.0 on 27 October with security lists that do not match: ten CVEs in 13.3.0's security section plus an eleventh fixed in its changelog, four in 13.2.5, three in 12.4.14. The collected records score 4.3 to 6.5, all Medium, and none is Critical.
2 stories
Nextcloud Spreadsheet joins Write and Present, with XLSX and ODS in tow
Nextcloud announced Nextcloud Spreadsheet on 26 October, a collaborative spreadsheet editor that runs inside Nextcloud and sits alongside Nextcloud Write and Nextcloud Present in Nextcloud Office. It opens and saves XLSX and ODS, does real-time co-editing, comments, autosave and version history, and is described by Nextcloud as open source, though no licence or repository appears in the announcement.
Stalwart reaches 1.0, with a schema meant to end migration projects
Stalwart, the self-hosted mail and collaboration server, announced v1.0 on 26 October. The release finalises the database schema so upgrades stop being migrations, rewrites full-text search with phrase matching and indexing inside PDFs and office documents, and publishes the project's own benchmarks against Postfix and Dovecot.
2 stories
Open WebUI 0.12.4 moves the image to Python 3.12 and tightens sharing
Open WebUI v0.12.4, published 25 October, rebuilds the Docker image on Python 3.12 and Debian 13, so pip packages inside the container need 3.12 support. It also makes Direct Integrations off actually disable saved tool servers, moves sharing changes into Access settings, and adds lazy skill loading plus visible context compaction.
Tube Archivist 0.6.0 can run as a non-root user, and the migration is not optional
Tube Archivist v0.6.0, published 25 October, can run under a dedicated non-root user, which meant removing the bundled nginx and serving media from the application. The release calls that a security improvement and a set of breaking changes: HOST_UID and HOST_GID go, ownership is yours to set, TA_BACKEND_PORT gives way to TA_PORT, media URLs changed, and Elasticsearch moves from 8.19.0 to 9.5.5.
4 stories
HTTP2Shell: CVE-2026-111497 is a Brotli flaw, and it is bigger than Node.js
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, not a Node.js bug. Versions 1.0.3 through 1.2.0 are affected on all platforms, fixed in 1.2.1 or the 1.0.10 and 1.1.1 backports, and the flaw works in both directions. This desk's 22 October Node.js story framed the scope too narrowly, and this is the correction.
Garage 2.5.0 makes lifecycle endpoints owner-only and will not downgrade
Garage v2.5.0, published 24 October, is the S3 store this desk named when MinIO archived its repository. It ships three upgrade notes that matter more than its feature list: no downgrading an upgraded node, bucket lifecycle endpoints restricted to owner-permission keys as a deliberate security change, and a new public_endpoint setting to add to garage.toml.
LiteLLM rotated its image-signing key, and the old pin will fail
LiteLLM's 24 October releases sign every Docker image and Helm chart with a new cosign key, remove the eMudhra root CA from its trust bundles, and mark both changes as present in 1.105.4, 1.104.6 and 1.103.8. If you pin the old public key in CI or an admission policy, verification fails until you replace it.
wg-easy 15.5.0 brings the October Node.js fixes and AmneziaWG 3.1
wg-easy v15.5.0, published 24 October, carries Node.js runtime updates the project describes as fixing some Node.js vulnerabilities, linking Node's October advisory, plus AmneziaWG 3.1 support, trusted-proxy handling and a promised configurable interface name.
3 stories
ntfy 2.33.1 rebuilds on Go 1.27.3 and makes cluster links visible
ntfy v2.33.1 rebuilds the service with Go 1.27.3 so certificate chains through the compromised eMudhra intermediates are rejected, adds per-peer and database pool metrics for its experimental cluster, and fixes the crash that hit older CPUs in 2.33.0. Take 2.33.1, not 2.33.0.
Paperless-ngx 3.3.4 is a security maintenance release, eMudhra included
Paperless-ngx published v3.3.4 on 22 October to update certifi for the eMudhra/emSign CA incident and to pick up security fixes in Pillow and aiohttp. The project calls all of it third-party dependency work and recommends updating for everyone; the documented Docker route is a backup, a stop, a pull and a foreground start.
Unraid 7.2.9 carries the PHP2Shell fixes and the eMudhra CA update
Unraid OS 7.2.9 is a targeted security patch for the 7.2 branch: PHP 8.4.27 covering ten CVEs including the PHP2Shell pair, a CA bundle that addresses the eMudhra compromise, and an API update whose bundled Node 22.23.4 resolves the certificate issue. Unraid still points 7.2 users at 7.3.4 for the newer kernel.
4 stories
eMudhra's CA keys were the number 4, and the company is leaving TLS
Eight eMudhra intermediate CA private keys were single-byte values recoverable from public certificates, so any trust store that still holds them can be forged against. Distributions have shipped ca-certificates updates, and eMudhra has announced it is withdrawing from the global SSL/TLS business.
GitLab's critical patch fixes a CVSS 10.0 unauthenticated RCE
CVE-2026-110264 is an integer overflow in GitLab's regular expression compiler that could let an unauthenticated user run code on the server. Patches are out for every supported line, with backports to older branches and two threat detections for self-managed instances.
MinIO's open-source repository is archived: nothing breaks, nothing gets fixed
The minio/minio repository is archived, with its last commit in April 2026, and the README now points at AIStor instead. Existing installs keep serving unchanged, but no further upstream fixes are coming, so the question is when to migrate and to what.
Node.js patches a Brotli RCE and two TLS hostname bypasses
Node.js published v26.12.1, v24.22.1 and v22.23.4 on 21 October with four issues rated high, including a Brotli decoder out-of-bounds write that permits remote code execution and two certificate hostname bypasses. The same releases refresh bundled dependencies, including the eMudhra CA fix.
3 stories
CVE-2026-99999: a critical Linux kernel flaw lets a guest attack the host
A critical IPv4 checksum bug in the Linux kernel lets a guest virtual machine, or any local sender of crafted packets, corrupt the host kernel's memory. The fix is upstream and backported, Red Hat tracks it as an active-exploit case, and there is no mitigation beyond a kernel update.
LiteLLM 1.107.0 on PyPI was malware: a stealer in every wheel
All seven 1.107.0 wheels installed a credential stealer and a remote-code loader that run on every Python start in that environment, not just when LiteLLM runs. PyPI has removed the release and the affected Docker tags are yanked; anyone who installed it needs to rotate credentials, not just uninstall.
The critical PHP RCEs are out, with fixes for every supported branch
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated RCEs, CVE-2026-109618 and CVE-2026-109619, and the project's own advice is blunt: there are no complete mitigations, updating is the only safe choice.
3 stories
PHP pre-announces a critical security release for 21 October, 14:00 UTC
The PHP security team will publish a security release on Wednesday 21 October at 14:00 UTC with fixes for two vulnerabilities rated CVSS v4.0 9.2. Affected versions, CVE ids and fixed builds come with the release, so the task now is to know which PHP your services run.
Plex2Shell: old Plex Media Server builds are being exploited for unauthenticated RCE
Four Plex Media Server bugs chain into unauthenticated remote code execution in builds before 1.43.3.10861. Plex announced the fix in September, a public proof of concept landed on 16 October, and one researcher's honeypot logged exploitation the next morning.
qBittorrent 5.3.0 fixes a WebUI authentication bypass in reverse-proxy setups
qBittorrent 5.3.0 fixes how the WebUI resolves the client address behind a reverse proxy, closing a spoofing bypass of the subnet whitelist, and adds session controls, RSS rule cloning and export, a backup revamp and a CSRF hardening pass.
1 story
Backups that restore, not just backups that run
A backup job that exits zero is a copy job until you restore something from it. The checks worth scheduling, the drill that finds the real failures, and the recovery kit people forget.
1 story
tinyfeed v1.5.1 makes its feed pages deterministic
The feed-to-static-page CLI's first release since April is a stability pass: stable ordering, discoverable sort options, six fewer indirect dependencies, four sorting and template fixes, and a new snapshot suite that renders more than 70 real-world feeds.
3 stories
Homepage v2.6.0 fixes a pre-authentication bypass in its built-in login
A high-severity advisory says an unauthenticated attacker could reach the dashboard, the service and bookmark APIs and the widget proxy on Homepage 2.0.0 through 2.5.0 by supplying a Next.js internal header; 2.6.0 fixes it, and a reverse-proxy rule is the stopgap while you update.
ntfy v2.31.1 fixes the database load that rolled back ntfy.sh from v2.31.0
Two days after v2.31.0 fixed messages lost on reconnect, ntfy ships the fix for the database overload that followed on ntfy.sh: an index that makes since= reconnects cheap again, friendlier schema handling for rollbacks, and exact upgrade notes.
Pi-hole v6.5 patches four high-severity local privilege escalations
The security release fixes four high-severity advisories and one low, all paths that turn a foothold as the pihole service account or its configuration surfaces into root, and ships hardening that includes a gravity schema migration; every affected version is patched in 6.5.
4 stories
Cloud Hypervisor v54.0 guarantees live migrations from the last two releases
The Rust VMM's first live-migration compatibility guarantee accepts arrivals from v52.0 and v53.0, and the release adds VFIO device migration and migration cancellation, changes two defaults, tightens upgrade checks, and fixes silent data corruption after live migration.
Haxy: a git forge in preview that keeps project metadata in the repo
The new MIT-licensed forge stores issues, discussions and patches as event commits on a repository branch so projects move between instances, serves its terminal UI over SSH, and warns that preview data is deleted before production.
Tasmota v16.0.0 ships a fix worth applying and a stricter upgrade path
The first v16 major of the ESP8266/ESP32 firmware fixes unauthenticated UFS writes on password-protected web interfaces, removes direct migration from versions before v8.1.0, and adds ESP32-S31, C61 and P4R3 support, optional MQTT 5.0, Matter 1.6.1 and expanded DALI-2.
Open WebUI v0.12.3 adds end-to-end encrypted chats the server does not store
The self-hosted AI interface gives direct messages and private channels temporary end-to-end encrypted sessions, encrypted in the browser with MLS and relayed without being saved; the same release removes Google Drive's verification wall for self-hosted installs and lightens Redis streaming.
2 stories
Forgejo v17.0 brings a by-hand webhook migration, and 16.0's support ends 29 October
The quarterly Forgejo feature release replaces the action-run webhooks with workflow-run events that cannot be migrated automatically, changes how absolute links resolve in repository documents, and lands as the 16.0 branch nears end of life on 29 October.
ONLYOFFICE Docs 10.0 turns JWT on by default and requires explicit WOPI hosts
A major release whose operator-facing parts are the defaults it changes: JWT on, WOPI hosts named explicitly, reworked converter tokens, new kill switches for the public APIs, and a 43-item security section that includes WOPI session hijacking.
2 stories
The blocklists carry GoatCounter's custom domains, and EasyPrivacy's ping rule catches cross-domain counting
GoatCounter's FAQ warns that custom domains will not prevent adblockers from recognizing it; AdGuard's DNS filter enumerates more than 230 of them, a generic ping rule catches cross-domain counting, and first-party or server-side counting is what remains.
Plimsoll runs agent-written code, and every result states the isolation tier it actually got
A self-hosted Go daemon that runs untrusted code, including code an AI agent wrote, and reports the isolation tier each run actually got — process, container, kernel or vm — refusing a run below the caller's stated floor before any code executes.
1 story
Memos 26.10-rc.1 drops the v1 API marker and renames its methods
The release candidate removes the v1 version marker, moves every REST route and gRPC procedure, renames a long list of methods and fields, and gives the old paths one release of 410 Gone, alongside editor suggestions and audio transcription.
9 stories
Debian's kernel update has 1,313 reasons attached
DSA-6528-1 lands an enormous CVE list in Debian 13's stable kernel. The count is the story: triage, then the reboot.
Vaultwarden's security release: a removed member could still read ciphers
Seven advisories in v1.37.4, topped by a High-severity organization revocation flaw; the upgrade notes change how proxy client IPs resolve and ask admins to rotate an API key.
FreshRSS 1.30.1 closes a stack of small doors
The feed reader's security point release strips token access from disabled accounts, guards the updater with POST and CSRF, and bounds ZIP imports against decompression bombs.
TrueNAS 27 RC.1 brings search, browser access, and flash where it matters
The release formerly tested as TrueNAS 26 ships its first release candidate on OpenZFS 2.4 and kernel 6.18: TrueSearch, WebShare, Fusion Pools 2.0, stateful SMB failover, and an early S3 interface.
Jellyfin 12.2 is a maintenance release with one very sensible refusal
Fifty-one changelog entries: Dolby Vision profile 8 moves to the hvc1 tag, malformed FLAC stops hanging the library, EPUB covers work on Windows, and a missing database now stops the server cold.
Stirling-PDF 3.1.0 makes document signing a default
Stirling Sign leaves alpha and turns on for new users, a faster Office converter arrives behind a beta flag, and the text editor learns to edit tables and OCRed PDFs.
Coolify 4.4 adds traffic analytics, SQLite, and single sign-on
The self-hosted deployment platform ships built-in analytics for Traefik and Caddy that store rollups only, an experimental SQLite database service, OIDC sign-in, third-party secret managers, and Cloudflare DNS management.
Dozzle adds host metrics, log filters, and updates with a rollback
Two releases in three days: 11.2.0 puts load, disk and uptime on the host card and adds a time filter for logs; 11.3.0 turns container updates into a managed operation that can roll back.
PhotoPrism's October release puts every AI model on the GPU
Classification now weighs the whole frame, NSFW detection is rebuilt on ONNX, every built-in model can run on a supported NVIDIA card, and new face clusters name themselves.
7 stories
Beszel 0.21.0 adds package updates, Wi-Fi signal and certificate expiry
The lightweight monitoring stack now lists pending package updates, tracks Wi-Fi signal strength, checks TLS expiry on HTTPS monitors, and shows systemd logs, with ten first-time contributors in the batch.
DwarfStar is an inference engine for the few models you actually run
Salvatore Sanfilippo's engine is deliberately narrow: DeepSeek, GLM and Qwen flash models on Macs, DGX Sparks and Strix Halo boxes, with SSD streaming for hardware that is almost big enough.
LocalAI 4.11.0 brings remembered speakers and failover chains
Audio scenes that keep track of who said what, ordered failover across local and remote models, structured decision endpoints and signed OCI galleries, in a 15-day window with 243 merged pull requests.
celld runs the Cloudflare Workers platform on your own machines
Deno's daemon gives you Workers, Durable Objects, KV, Queues, D1 and R2 as open source on your own hardware, with a storage bucket as the only shared state.
coreboot 26.09 hardens its parsers and writes down an AI policy
Over 1,300 commits from 120 authors, audits across every external format the firmware parses, DDR5 SPD caching with TPM-backed verification, and rules for how AI may comment on patches.
Ubuntu 26.10 completes the Rust coreutils switch and adds Sequoia PGP
cp, mv and rm are the last GNU utilities to go; sq and sqv arrive in the main archive beside gpg, and the OpenSSH packages split to shed a Kerberos patch upstream never took.
OpenRadioss is gone, and the repository was deleted, not archived
Four years after Altair open-sourced its crash-simulation solver, Siemens says it is consolidating efforts into Simcenter, and the GitHub repository has simply been removed.
8 stories
Kolibri is Aleph Alpha's open-weight bet on on-premise AI
An English-German mixture of experts, 78B total parameters and 3B active, Apache 2.0 with a vLLM plugin: built for regulated sectors and benchmarked against models with four times the active size.
gVisor is being donated to the CNCF
Google hands the sandboxed container runtime to the foundation behind Kubernetes: Sandbox status first, the repository leaving the google org, and a maintainers model with Ant Group, Modal and Tines joining.
Valet runs Claude Code and Codex in sandboxes you host
A self-hosted control plane for cloud coding agents: per-thread containers, one compose file, accounts you connect yourself, and an unusually honest security note about what a sandbox can reach.
pi pod runs your pi coding sessions in sandboxes you host
A CLI plus iOS and Android apps drive pi agent sessions in remote sandboxes, with the control plane, sandbox service and both apps in one AGPL repository, installed as a single Compose project.
GNOME's CVE wave and the case for AI vulnerability reports
141 CVEs through September against 13 in 2023, and WebKitGTK at 305: a GNOME security lead argues scanning is now mandatory and that policies banning AI-generated reports will only hide the flaws.
Caddy 2.11.7 fixes the regressions 2.11.6 introduced
An HTTP/2 proxy crash, streams cut off after a minute of quiet, empty cookie placeholders: the follow-up patch is out less than two days later, with the new Incremental header as the feature.
The repo that wasn't: a fake client and a post-checkout hook
Frank Wiles describes a targeted attack that arrived as a normal project inquiry and hid a .git repository whose post-checkout hook fetched and ran an OS-specific binary on branch switch.
The forgetful CPU: booting Linux on an M4 Mac mini
M4 is the first Apple silicon where the WFI instruction loses register state, a spec violation baked in from the factory. Yureka Lilian's write-up covers the fix, now merged into mainline Linux and m1n1, that boots M4 machines with all cores.
4 stories
Home Assistant Cloud is being renamed Home Assistant Link
Nabu Casa says the old name never fit: people thought the subscription ran Home Assistant in the cloud, and it never did. The new name goes official in the December 2026.12 release.
Vikunja 2.7.0 ships six security fixes and an MCP server
The task app's release lands 856 commits, one high and five medium vulnerabilities, scoped tokens so assistants can use your tasks safely, a rebuilt date picker and a proxy for servers without direct internet.
Linux 7.4 gets its first Apple M4 device trees
Asahi's Sven Peter sent the initial device trees for the M4 MacBook Pro, iMac, MacBook Air and Mac mini, plus the A18 Pro MacBook Neo: enough to boot the kernel, not yet enough to use the machines.
systemd-appd would put app identity and permissions in one place
A draft pull request proposes a new systemd component that lets session services reliably identify running apps and read their permissions over Varlink, built for the Flatpak 2.0 effort.
8 stories
Pi 1.0 ships with MCP support and a durable runtime for long-running agents
The minimal agent harness reaches 1.0 with a JavaScript tool sandbox, deferred tool loading and Anthropic cache warming, and spins out Pi Durable for agents that checkpoint every step to SQLite or JSONL.
The IFPI wants yt-dlp on the EU's piracy watch list
A submission to the European Commission calls the downloader "a major problem for the music industry" and names four maintainers by GitHub handle, while asking for nothing concrete.
Zigbee2MQTT 2.14.2 adds 83 devices and fixes the quiet failures
A Miele induction hob, Philips Hue hardware, a Somfy curtain motor and dozens of Tuya-family modules join the supported list, alongside fixes for cover states, MQTT reconnects and transaction handling.
BookOrbit is a self-hosted library for ebooks, comics and audiobooks
A new AGPL-3.0 reading platform with built-in readers, three-way Kobo and KOReader sync, metadata from 14 providers, and OIDC login, in one Docker deployment.
Eigen is a self-hosted workspace built as one product, not a platform
Mail, drive, docs, sheets, slides, drawings, kanban, calendar, contacts and chat in one server, with one codebase and per-user SQLite. It is pre-1.0, built by one person, and candid about it.
LocalThings drives Samsung appliances from Home Assistant, without the cloud
An MIT-licensed Home Assistant integration that talks to washers, fridges, ovens and more over the local network, using the appliances' own OCF and CoAP interfaces.
LibreChat v0.8.8 adds steering, approvals and background tasks for agents
The self-hosted AI chat's new release lets you interrupt, steer, queue and approve what agents do mid-run, and bundles background tasks, scheduled chats and a refreshed model lineup.
Raspberry Pi lifts 2GB prices as the memory crunch tightens
A $12.50 increase on the 2GB Pi 4 and Pi 5, straight from the memory market, while Micron says supply stays tight through 2028 and its margins say it is not suffering.
11 stories
Pangolin 1.24 adds exit nodes and on-demand clients
Exit nodes send a client's whole internet connection out through a chosen site, while the desktop and phone clients get on-demand tunnel activation, a rebuilt UI, and a subnet router for Linux.
Songhive is a self-hosted music platform where tracks play from Mastodon
A new AGPL-3.0 project from Fabio Manganiello puts a streaming server and an ActivityPub social layer in one stack, with Subsonic clients, server-side outputs, and Stripe plumbing for artists and instance keepers.
Immich v3.3.0-rc.1 makes people shareable and adds birthday memories
The second candidate for v3.3 opens people sharing across accounts, adds birthday memories and edit stacking on mobile, and syncs OAuth claims on every login. Still a release candidate.
AdGuard Home's beta channel jumps to 1.0.0 and switches to the new UI
The beta channel moves from 0.108.0-b.91 to the project's first 1.0.0 build, bringing the new UI, a Go security bump, four small fixes, and the end of macOS 13 support.
Caddy v2.11.5 is a 119-commit patch, security fixes first
The first release since June carries fixes for a url_pattern authorization bypass, an HTTPoxy hole in FastCGI, slowloris exposure, a sticky-session timing side channel and a Windows path bypass, plus new matcher and header options.
Gitea 28.0.0 drops the 1. from its version, opens audit logs, and reroutes Git traffic through a proxy
A major release with three breaking lines for busy instances: Git network operations now go through an internal proxy with new egress settings, Actions can auto-delete old runs, and 32-bit and gogit builds are gone. Audit logging, bot accounts, deploy tokens and admin impersonation lead the features; the security write-up lands in about a week.
OPNsense 26.7.5 switches password hashing to argon2id and closes a policy-lock hole
The point release carries a low-severity fix for a password-policy lock that an empty Save could clear, moves the default hash from bcrypt to argon2id (optional, existing hashes keep working), and takes the outbound NAT page to the legacy plugin without breaking rules.
Plasma 6.8 enters beta: the first Plasma with no X11 session, landing on October 14
The Wayland-only switch is official: no X11 session at login, with XWayland carrying old apps. The beta adds kup as Plasma's backup tool, pushes Union theming into QtWidgets apps, and builds out the remote-desktop stack, with the X11 session supported into early 2027 for anyone not ready.
Backblaze Q2 2026 drive stats: AFR at 1.73%, and Seagate takes the honor roll
354,415 drives, 1,498 failures and a quarterly AFR of 1.73%, the highest in a while, with the report naming its own reasons. Three Seagate models went the quarter without a failure, and the 20TB-and-up cohort keeps posting the best numbers.
Sécurix: the French state's hardened NixOS, where the password is only a fallback
The DINUM's SécurixOS is an alpha NixOS build for secure workstations: ANSSI hardening, a custom kernel, FIDO2 login and disk unlock, TPM2 and centralised Secure Boot, and age or Vault for secrets. It is MIT, it is not a fork, and it is not for everyone yet.
Archinstall 4.5 adds real-time kernels and AArch64 EFI boot ahead of October's ISO
The installer for October's Arch ISO refresh gains linux-rt options, GRUB and Limine EFI support on AArch64, moves its four Wayland compositor profiles from polkit to systemd-logind, and fixes a class of unverified fetches.
4 stories
HouseOS's first release is a home server suite that leaves the smart home to Home Assistant
One computer at home runs films, music, games, files, the household board and an AI assistant called Nox, while lights, plugs and the TV remote go through Home Assistant. It is a first release, and it knows it.
Reitti's September batch arrives with a timeline upgrade and a security fix to catch up on
A rebuilt timeline with type-ahead date navigation, better visits from sparse tracker data, Panoramax street photos on your tracks, and the admin-rights setup bypass fixed in v5.3.2 that is worth confirming you have.
Flatpak 1.18.4 closes six ways a malicious app could reach the host
One release, six CVEs: privileged overwrites and deletions of host files, an authentication token visible to other users, loose temporary-directory permissions, unfiltered desktop and D-Bus files, and a signal that could kill the desktop environment.
wanderer's mobile app enters public beta, and admins need one new env var
The self-hosted trail database ships a public beta of its Android and iOS app, a security pass across eight advisories, and one required environment variable that must be set before the server upgrade.
10 stories
Calibre-Web-Automated v4.0.7 fixes four access-control holes and makes Kobo sync much faster
The self-hosted ebook library turns four access-control problems into admin-only territory — a cross-user Kobo token flaw, unauthenticated service pages, spoofable internal endpoints and a guest-reachable EPUB fixer — and rewrites Kobo sync so large libraries stop spending up to 15 seconds per request.
openSUSE Leap 16.1 reaches release candidate, and its Immutable Mode replaces Leap Micro
The RC lands with Immutable Mode selectable in the installer — read-only root, transactional-update snapshots, rollback — appliances that carry over from Leap Micro, and an experimental migration tool for 6.2 boxes. Same GNOME 48; Plasma moves to 6.6.
Seerr v3.5.0 ships one breaking API change and a long request-flow fix list
Two library endpoints stop syncing as a side effect of being read — API consumers move to POST .../sync and PUT .../{id} — and the UI gets ntfy tags, Gotify poster embeds, a hide-already-requested toggle, and fixes across quotas, seasons and duplicate requests.
The steal governor is queued for Linux 7.4: a guest-side fix for the noisy neighbour problem
A v14 series from IBM's Shrikanth Hegde merged into tip's sched/core this morning: when steal time says the host is contended, a guest folds its work onto a preferred subset of vCPUs — one core at a time, checked every second, never below one core — with no cross-guest communication.
ChangeDetection.io 0.60.8: a first PWA, cached assets, and LLM summaries that stop blocking
The self-hosted page watcher gets HTTP caching for its UI assets, its first PWA support, LLM summaries that run without freezing the interface, stricter type checks on imports and API updates, and a leaner title extractor.
Aldine: a two-container Overleaf alternative where every paper is a git repo
A self-hosted LaTeX collaboration platform that installs as two containers, keeps every project as a real git repository with branches and merges, syncs to GitHub, GitLab, Gitea or Forgejo, links Zotero for free, and recompiles warm documents in about two seconds.
Genug Analytics is web analytics you ask, not read: one Node process, one SQLite file
A self-hosted analytics tool (MIT) that takes a script tag, stores events in one SQLite file, and answers questions through Claude, Cursor or any MCP client — thirty-two tools, no cookies by default, and a cockpit for when you would rather look.
MeTube 2026.09.27 adds per-download video passwords, and a cancel that actually stops
The self-hosted yt-dlp web UI gains a video-password field for protected videos (pairable with presets), a full row for custom yt-dlp options, Python 3.14 in the image, and a fix so cancelling a download actually sends the right signal.
Dozzle v11.1.2 hardens the log viewer's edges: escaping, sanitizing, scoping
A small release for the self-hosted Docker log viewer where most of the fixes share one theme: untrusted text — container names, log lines, image labels — now gets escaped or sanitized everywhere it could reach beyond plain display.
postmarketOS is now Nura: a new name from Sardinia's 3,000-year-old towers
The Linux-mobile project revealed its new name at its own conference after an 18-month search: Nura, an abbreviation of Nuraghe — the Sardinian granite towers that have stood for three millennia — with a new .eco home and a refined logo. Same OS, same maintainers.
4 stories
LGM-OS is a one-developer NAS OS on Debian, free while the launch campaign lasts
A NAS OS from a single developer that installs Debian 12 on any 64-bit PC and runs everything from a browser: Btrfs or ZFS pools, 31 curated apps plus a converted community catalog, KVM virtual machines, cameras, versioned backups and a WireGuard VPN. Two months old, 252 versions deep, and an outside audit already reshaped 2.0.
AlmaLinux now certifies software, and hardware runs finish in under ten minutes
Two years after the hardware program, AlmaLinux adds software certification, rewrites the alma-certify suite so most runs finish in under ten minutes, and opens a public catalog where vendors and community members both file their confirmations.
Linux 7.4 will reset a hung Raspberry Pi GPU through the V3D block's own reset line
The vc4 driver has been recovering a hung GPU by forcing the V3D power domain down and back up, with a private refcount wrapped around every runtime PM call to keep the count honest. An Igalia series moves the reset onto the BCM2835 PM block's reset line instead, and it is queued for the Linux 7.4 merge window.
A Guix image that uploads straight to Linode, with the whole recipe in the open
The Guix cookbook starts from Linode's Debian image and converts it. David Thompson wrote down the other route: a disk image you build with guix system image, strip down to just the root partition, gzip, upload, and flip two boot-profile switches. The full OS config and packing script are in the post.
14 stories
Webtop 5.0 and Selkies 2.0 bring five codecs, WebRTC, and self-configuring GPUs
Selkies 2.0.0 rebuilt every LinuxServer.io desktop container on a new streaming stack: five codecs behind one fallback ladder, WebRTC as a first-class transport, zero-copy capture on X11, and an x86_64 GPU the container configures on its own. Here is the short list of things to change.
Pi Maps gives a Raspberry Pi offline maps and routing, Western Australia first
A new self-hosted map stack for a Raspberry Pi: local vector maps, local search, BRouter driving routes and an optional Wikipedia layer, all served from a verified data bundle with no public geocoder or map API involved. The first supported edition is Western Australia on ARM64.
Technitium 15.5.1 patches a session-token leak and a logs-view XSS
Seven days after the nine-fix 15.5 release, the follow-up patches a session-token prefix oracle that let a low-privilege user recover any active session's full token, a logs-view XSS, and a recursive-resolver regression that broke resolution for some domains.
GNOME proposes Toolpak: signed disk images for the tools that can't run confined
A GNOME OS developer's proposal for the gap between Flatpak and the tools that refuse to be sandboxed: developer utilities shipped as signed, verity-checked disk images, mounted in a namespace and prepended to your PATH. It is a funded prototype, not a product.
Floci runs 119 AWS services on localhost, with no account and no auth token
An MIT-licensed local AWS emulator that answers on port 4566, with real Docker engines behind the services where fidelity matters, and sibling emulators for Azure, GCP and OCI.
Wisp puts snapper's snapshots in the GNOME top bar, and runs nothing as root
A GNOME Shell extension for btrfs machines that turns snapper's snapshots into a top-bar menu: browse, compare, restore single files, roll back, and hand you the root command instead of taking it.
KryonOS boots an ESP32 into a desktop, and its apps install over Wi-Fi
A GPL-3.0 GUI and JavaScript runtime for the ESP32: flash the board once, then install and update apps from an on-device store, on a machine with about 90 KB of RAM to spare.
Pingularity keeps the receipts on your internet connection
A self-hosted dashboard that probes your connection every few seconds and runs speed tests on a schedule, keeping outages, latency, DNS and bufferbloat in a SQLite file you own.
Kiteworks told its customers to shut down for a weekend window, with nothing to patch
Self-managed Kiteworks systems were told to go offline for a window over the weekend after federal threat intelligence warned of an imminent attack. No compromise is known and there is no patch to apply; the customer email and the company's press release disagree on the window.
CARBONATO's payloads sat in an exposed Docker registry, and AI keys topped its loot list
ThreatDown traced a botnet through its own unauthenticated registry, recovered the implants, and found an agent persona that ranks AI API keys above every other secret on the host.
Nginx Proxy Manager 2.16.0 adds a logs viewer and per-path access lists, with a certbot warning attached
First release since June: a logs viewer and per-path access lists headline, a security batch underneath, and the bundled certbot bump comes with a warning for DNS plugin users.
Stirling-PDF 3.0 adds the Processor, and a licence line at 1,000 PDFs a month
Version 3.0 turns batch work into pipelines that watch folders, FTP and S3, keeps the AI features optional, and draws the free line for automated processing at 1,000 PDFs a month.
F-Droid 2.0 rebuilds the client around three tabs, and updates now run themselves
The largest update in a decade replaces the navigation, redesigns Discover, and uses Android's pre-approval install API. The post is candid about what did not come back.
Samba 4.25.0 switches to AES-only enctypes and ships persistent handles as experimental
The first stable of the 4.25 series makes AES the default key set on modern domains, fixing CVE-2026-20833, and offers SMB3 persistent handles with an unusually direct cost list.
7 stories
The Terraform registry has malware now, and it stays asleep until one hash matches
Aikido found a Go implant in two registry providers and two Go modules. It does nothing unless the SHA256 of two Terraform variables hits one value, then runs a remote-access tool with Slack and Ethereum command channels. Both providers were still listed on Wednesday night.
Raspberry Pi OS gets a dock and a launcher, and nothing changes unless you ask for it
The September update modernises the desktop with an icon dock, a full-screen launcher and a rebuilt Control Centre, all optional. The same week, the two-year-old firmware lock on RAM upgrades resurfaced because memory prices keep climbing.
Gravity Linux is a Fedora remix for Apple Silicon that plans to sunset itself
An early alpha for the M4 Mac mini from two developers who forked from Asahi over its LLM policy: KDE on Wayland, working GPU acceleration, and Assisted-By trailers on the kernel commits.
Jev returns decisions instead of prose, and the local version is 25 lines of Python
TypeSafe's decision model charges $0.042 per million input tokens with free output; a parody post and two open rewrites show the trick runs on any GGUF model, and a coin-flip test shows where the numbers get shaky.
HolaOS is an agent workspace you run yourself, under a licence that says do not sell it as a service
11.3k stars, one-line install on macOS, Linux or WSL, apps running beside the agent and memory kept as plain files. The modified Apache 2.0 licence is the part to read before you standardise on it.
Linux 7.3 is reverting its new Logitech Bolt support after the scroll wheels went crazy
The HID++ support merged for 7.3 is coming back out: the receiver cannot say which device sent an event, and userspace settings fight the new defaults. The revert is queued for the 7.3 fixes branch.
Fedora 45's installer can build root and home on Stratis now
Anaconda gains a Stratis option: pools and filesystems through Cockpit, plus stratispool and stratisfs for kickstart installs. Caching and passphrase-free encryption still wait for post-install.
26 stories
Opus 5.5 and GPT-6 Sol and Luna both cut their prices, ten days after a call to slow the frontier
Anthropic and OpenAI shipped cheaper flagships on Tuesday, and Anthropic's own announcement says Opus 5.5 is the first release since the pacing essay.
Technitium 15.5 patches nine vulnerabilities, three from Palo Alto Networks
The DNS server's release notes read like an advisory first: nine vulnerability fixes, most credited to outside researchers, with LDAP logins and a zone file editor alongside.
TrueNAS's Proxmox plugin automates the storage wiring you used to do by hand
A native Proxmox storage backend turns VM disk requests into zvols on the array, delivers OpenZFS snapshots over iSCSI or NVMe/TCP, and ships now as an Early Adopters release, Community Edition first.
Seerr: the unified Jellyfin–Plex–Emby request manager, seven months on
Jellyseerr and Overseerr merged into one project in February; since then Seerr has ended its feature freeze, patched a critical security release, and kept a steady preview train; the newest branch reworks authentication around OpenID Connect.
Needle 2 turns plain English into local actions on a Raspberry Pi 5
Raspberry Pi's walkthrough runs Cactus's Needle 2 on a Pi 5's CPU: 'turn the LED on' becomes code in 78 milliseconds, with no AI HAT and no cloud call in the loop.
JetKVM Mini is a $39 matchbox KVM, and it ships October 26
The new Mini keeps JetKVM's web interface, cloud and open firmware in a 42 mm aluminium case: $39 wired, $42 wireless, $33 a unit in threes, using an ESP32-P4X where the original needed a Linux system.
Every Unbound through 1.26.0 has a heap overflow in its DNSSEC validator
A DNSKEY whose owner pointer compresses into its own RDATA overflows the digest buffer; the advisory rates it denial of service and possible remote code execution, and 1.26.1 fixes it.
Forgejo closes a patch-apply RCE that the last fix missed
v16.0.5 and v15.0.9, both out 17 September, patch a critical RCE reached by applying a patch, plus a CSRF that could attach an unexpected OpenID identity to a logged-in account.
CrowdSec's private repos left through an access it kept open, and a breach forum told it
Nine minutes of downloads in May, four months of quiet, and an incident report that names the kept-alive account and the compromised laptop behind it.
Duplicati 2.4.0.0 will refuse a data folder it does not trust
The new stable treats the data folder's permissions as a hard requirement: exact permissions or it will not run, with three documented ways out for the setups that cannot comply.
Proxmox VE is officially on ARM64, and the ecosystem is the missing half
PVE 9.2 for arm64 shares the codebase and release cycle with x86-64; the hands-on reports agree the platform works and the tools around it still lag.
TigerGraph's default container gives away SSH access, and the vendor has no fix out
Four default settings in tigergraph/community:latest compose into command execution as the database's own service account, using no secret that is not already public.
Relaticle is a self-hosted CRM where the AI proposes and you approve
AGPL-3.0, five containers, your own model keys, and an approval card in front of every update or delete an agent wants to make.
PeppermintOS moves its ISOs to XLibre, the fork for people staying on X11
Upcoming ISOs shift from Xorg to the maintained X11 fork, with no near-term Wayland plans. The last distro to try this lost a maintainer over it.
Sandopolis is a Sega emulator in Zig, and it serves itself to your LAN in one container
MIT-licensed, alpha, five Sega systems, a Libretro core and a browser build you can run from ghcr.io with one docker run.
WordPress 7.1.2 fixes an unauthenticated path traversal that ends in code execution
The bug needs a theme with a top-level `page-` directory and a readable local `.php` file, and the official PHP Docker image supplies the second half.
Git 3.0's breaking changes are now written down, and there is still no date
New repositories will default to SHA-256, reftable and the branch name `main`, Rust becomes a required part of the build, and the last 2.x ships as a long-term support release.
walkytalky is self-hosted, and self-hosting means your own Firebase project
An MIT-licensed iOS chat app with real end-to-end encryption and no service behind it. The data plane is Firebase, and the account, the rules and the console are Google's.
systemd 262 fails a notify-reload service that ignores its reload signal
The upgrade notes for 262 are mostly a breaking-change list: services that neither catch nor block `ReloadSignal=` now fail to start, and TPM-sealed credentials are pinned to the SRK.
Tailscale is replacing the one-lane path through subnet routers
Subnet routers, app connectors and exit nodes run every stream through a single ordered pipeline today; multi-queue lands after v1.104, and netmap caching comes first.
Drop gives an untrusted program a user namespace instead of a container
A rootless sandbox shaped like a virtualenv: its own home, its own namespaces, no capabilities, built for coding agents run with `--dangerously-skip-permissions`.
Epure keeps the Sentry SDKs and cuts self-hosted error monitoring to two containers
Exception-only error monitoring over Postgres 16: change the DSN, get grouped issues, and watch transactions, replay and profiles get dropped at the door.
An npm maths library that only wakes up when you solve the right equation
mathmain ships an encrypted implant that stays dormant until a caller passes one specific matrix to its solver, and the code is missing from the GitHub repository the package links to.
VMs that keep running while the host kernel is replaced
A 46-patch RFC keeps KVM guests executing on shielded physical CPUs through a host kexec, under a small privileged layer that services their exits while no host kernel and no VMM exist.
Self-hosting behind carrier NAT, with a VPS as the bridge
A machine behind carrier-grade NAT reached through a cheap VPS and a WireGuard tunnel, with the home side initiating, the routing split so replies go down the tunnel, and the measured cost in latency.
A voice agent in one process, with the latency numbers published
fusion-runtime runs speech recognition, an LLM and speech synthesis in one process, and its benchmark section publishes the number that makes it look worse and explains why the stages do not add up.
5 stories
A Pi 5 EEPROM update stops boards whose SDRAM the bootloader does not expect
EEPROM 2026-05-11 stops a Raspberry Pi 5 booting when the memory it finds does not match the memory it expects, and the halt happens before the OS loads, so the fix is a recovery image and a downgrade.
Homebrew 7.0.0 adds a vulnerability scanner and drops Intel Macs to Tier 3
Homebrew 7.0.0 ships brew vulns for checking installed packages against an in-house advisory database, fixes eight advisories, sandboxes installs, and moves Intel Macs to Tier 3 with no new bottles.
Cambium is in administration, and cnMaestro Cloud has a date on it
Cambium Networks Limited entered administration on 14 September, cnMaestro Cloud is only promised to run through 1 October, and the recommended migration to on-premises still needs an account on the same cloud.
Ubuntu 26.10 kills your applications before it kills your session
Ubuntu 26.10 gives critical desktop services a lower OOM score and disables systemd-oomd's session kill, so memory pressure takes out applications instead of the desktop session.
GoatCounter counted 200 humans where GoAccess counted 2,000 visitors
Vincent Bernat replaced log analysis with self-hosted GoatCounter and a client that only counts after a real interaction, which cut a reported 2,000 daily visitors down to fewer than 200 people.
9 stories
Portainer 3.0 goes Kubernetes-first, and Docker support stays where it is
Portainer 3.0 rebuilds the product around Kubernetes. Community Edition stays on 2.x, Docker environments keep working but stop growing, and the recommended path out is a Docker-to-Kubernetes translator.
Nextcloud Hub 26 Summer ships as Server 35, with Office heading to the desktop
Nextcloud Hub 26 Summer is out as Server 35.0.0, with a Euro-Office desktop client, team workspaces, a redesigned Photos app and one-time passwords for shares, while Hub 25 Autumn goes end of life.
Frigate 0.18.0: the config moves into the UI and the annotated JPEGs go away
Frigate 0.18.0 is the first stable of the 0.18 line, bringing full UI configuration, profiles, a GenAI chat agent and rebuilt exports, with a config migration, a WebP-only snapshot change and an FFmpeg 8 trap in go2rtc.
Immich 3.2 rebuilds search and recognises people across accounts
Immich 3.2.0 lands a new search API and cross-user face grouping that requires a facial recognition reset, and drew two hotfixes in the five days after release.
Grafana patches a plugin-archive RCE and a Geomap XSS in four releases
Grafana's 15 September releases — 12.4.11, 13.0.9, 13.1.6 and 13.2.2, one per branch — fix a plugin-extraction path traversal that can run code as the Grafana server, plus a Geomap stored XSS.
Jellyfin 12.1 is a bugfix release, and several fixes land on the 12.0 upgrade
Jellyfin 12.1 is 47 fixes six days after 12.0, and several of them touch the migration and the pre-migration backup.
Tailcat is netcat over Tailscale's data plane, with no account and no control plane
Tailscale open-sourced tailcat, a netcat-like CLI and Go library that connects two machines over the same WireGuard and NAT-traversal stack as Tailscale, without an account, a control plane or any IP addresses.
umbrelOS 2.0 arrives September 22 with multiple users and RAID storage
Umbrel's biggest update to its home-server OS adds multiple users, a Photos app, iOS and Mac apps, GPU support, an MCP server for AI agents, and a Storage Manager with RAID.
Jellyfin 12.0: modern on the surface, rebuilt underneath
Jellyfin 12.0 makes its Modern layout the default and rebuilds how playlists and collections are stored — and it rewrites your database on first boot, so the backup is the only way back.
Back to top · The newswire has every release, patch and advisory