Distributions, kernels, hardware and everything that did not fit a job above.
nspawn 3.0.0 puts a Docker Engine API on the host at /run/nspawn/api.sock, so tools that speak Docker can manage systemd-nspawn machines, and 3.2.1 adds arm64 packages marked experimental. The socket ships off and takes two commands to enable, an optional drop-in answers on /run/docker.sock, and the project warns that any user with org.nspawn.manage is root on the host.
PyPI's redesigned project pages went live on 6 November with a Security tab that reports a release's provenance: full, none, incomplete, inconsistent, changed or lost. The post is explicit that no provenance does not mean malicious, that it means the file origin cannot be cryptographically verified, and that the states worth checking before you install are the warnings.
What Immich does that the cloud does not, how you use it once it is running, and the install that keeps it running. One evening of setup, then a photo library you own.
Immich is the pick for most self-hosters. It is the only one of the three with official mobile apps, it searches on the server, it speaks OIDC and its backup covers the database, at a documented 6 GB minimum and an x86-64-v2 requirement that stops older hardware cold. PhotoPrism is the smaller install at 3 GB, with a PWA instead of an app. Ente is the only one where the server never holds a plaintext photo, which is why self-hosting it means building your own apps.
Readeck stores the readable content of a web page rather than a bookmark pointing at it, which is the whole pitch and the reason to run it. It ships as one executable, runs happily on 512 MB and a forgotten Raspberry Pi 2, and installs from a single docker run or a short compose file with one volume holding database and bookmarks. This profile covers the documented install path, the settings that matter behind a proxy, the export and import commands, and the limits the documentation states.
Alpine's advisory of 5 November describes a password authentication bypass in sshd built without PAM on musl: an attacker who can reach the SSH port logs in with a very long password as an account whose password field is *, provided another account on the machine has a $5$ or $6$ hash. Upstream OpenSSH 10.6p2 calls it a critical security workaround and puts the root cause outside sshd. Alpine's fixed packages run from edge 10.6_p2-r0 back to 3.16 9.0_p1-r6, the upgrade is not complete until sshd is restarted, and no CVE had been assigned.
DSA-6607-1 fixes CVE-2026-109518, found by Max Justicz: an HTTP redirect can leave two package downloads sharing a URI, and resume handling then lets a man-in-the-middle replace a package after verification, running code as root. Debian's tracker lists trixie fixed at 3.0.4 and bookworm at 2.6.2, with forky and sid at 3.3.5 in the package table and 3.3.6 listed only in the fixed-versions table. The same update also addresses out-of-bounds access issues in apt, and neither document carries a severity score.
Ubuntu's status post puts the CVE-2026-98432 kernel fixes in the -proposed pocket for 22.04, 24.04 and 26.04, with 26.10 already fixed in 7.3.0-10.10, 16.04 through 20.04 still pending, and 14.04 listed as not affected. The post also says plainly that mitigations disabling multipath TCP are not the fix, because the flaw is not specific to MPTCP, and it documents the opt-in install path with the warning that -proposed packages are not upgraded by default.
CVE-2026-98432 is a race in the Linux kernel's handling of IPv4 TCP options, where a retransmitted SYN can free a structure another thread is still reading. The record carries a 9.8 critical CVSS v3.1 vector and stable backports, and Anthropic's write-up names it as the kernel bug behind a zero-click chain that reached a root shell on servers with a multipath TCP listener.
A critical IPv4 checksum bug in the Linux kernel lets a guest virtual machine, or any local sender of crafted packets, corrupt the host kernel's memory. The fix is upstream and backported, Red Hat tracks it as an active-exploit case, and there is no mitigation beyond a kernel update.
DSA-6528-1 lands an enormous CVE list in Debian 13's stable kernel. The count is the story: triage, then the reboot.
Over 1,300 commits from 120 authors, audits across every external format the firmware parses, DDR5 SPD caching with TPM-backed verification, and rules for how AI may comment on patches.
cp, mv and rm are the last GNU utilities to go; sq and sqv arrive in the main archive beside gpg, and the OpenSSH packages split to shed a Kerberos patch upstream never took.
141 CVEs through September against 13 in 2023, and WebKitGTK at 305: a GNOME security lead argues scanning is now mandatory and that policies banning AI-generated reports will only hide the flaws.
M4 is the first Apple silicon where the WFI instruction loses register state, a spec violation baked in from the factory. Yureka Lilian's write-up covers the fix, now merged into mainline Linux and m1n1, that boots M4 machines with all cores.
Asahi's Sven Peter sent the initial device trees for the M4 MacBook Pro, iMac, MacBook Air and Mac mini, plus the A18 Pro MacBook Neo: enough to boot the kernel, not yet enough to use the machines.
A draft pull request proposes a new systemd component that lets session services reliably identify running apps and read their permissions over Varlink, built for the Flatpak 2.0 effort.
The minimal agent harness reaches 1.0 with a JavaScript tool sandbox, deferred tool loading and Anthropic cache warming, and spins out Pi Durable for agents that checkpoint every step to SQLite or JSONL.
A $12.50 increase on the 2GB Pi 4 and Pi 5, straight from the memory market, while Micron says supply stays tight through 2028 and its margins say it is not suffering.
The Wayland-only switch is official: no X11 session at login, with XWayland carrying old apps. The beta adds kup as Plasma's backup tool, pushes Union theming into QtWidgets apps, and builds out the remote-desktop stack, with the X11 session supported into early 2027 for anyone not ready.
The installer for October's Arch ISO refresh gains linux-rt options, GRUB and Limine EFI support on AArch64, moves its four Wayland compositor profiles from polkit to systemd-logind, and fixes a class of unverified fetches.
A rebuilt timeline with type-ahead date navigation, better visits from sparse tracker data, Panoramax street photos on your tracks, and the admin-rights setup bypass fixed in v5.3.2 that is worth confirming you have.
The self-hosted trail database ships a public beta of its Android and iOS app, a security pass across eight advisories, and one required environment variable that must be set before the server upgrade.
The RC lands with Immutable Mode selectable in the installer — read-only root, transactional-update snapshots, rollback — appliances that carry over from Leap Micro, and an experimental migration tool for 6.2 boxes. Same GNOME 48; Plasma moves to 6.6.
A v14 series from IBM's Shrikanth Hegde merged into tip's sched/core this morning: when steal time says the host is contended, a guest folds its work onto a preferred subset of vCPUs — one core at a time, checked every second, never below one core — with no cross-guest communication.
A self-hosted analytics tool (MIT) that takes a script tag, stores events in one SQLite file, and answers questions through Claude, Cursor or any MCP client — thirty-two tools, no cookies by default, and a cockpit for when you would rather look.
The Linux-mobile project revealed its new name at its own conference after an 18-month search: Nura, an abbreviation of Nuraghe — the Sardinian granite towers that have stood for three millennia — with a new .eco home and a refined logo. Same OS, same maintainers.
Two years after the hardware program, AlmaLinux adds software certification, rewrites the alma-certify suite so most runs finish in under ten minutes, and opens a public catalog where vendors and community members both file their confirmations.
The vc4 driver has been recovering a hung GPU by forcing the V3D power domain down and back up, with a private refcount wrapped around every runtime PM call to keep the count honest. An Igalia series moves the reset onto the BCM2835 PM block's reset line instead, and it is queued for the Linux 7.4 merge window.
The Guix cookbook starts from Linode's Debian image and converts it. David Thompson wrote down the other route: a disk image you build with guix system image, strip down to just the root partition, gzip, upload, and flip two boot-profile switches. The full OS config and packing script are in the post.
A new self-hosted map stack for a Raspberry Pi: local vector maps, local search, BRouter driving routes and an optional Wikipedia layer, all served from a verified data bundle with no public geocoder or map API involved. The first supported edition is Western Australia on ARM64.
A GNOME OS developer's proposal for the gap between Flatpak and the tools that refuse to be sandboxed: developer utilities shipped as signed, verity-checked disk images, mounted in a namespace and prepended to your PATH. It is a funded prototype, not a product.
A GNOME Shell extension for btrfs machines that turns snapper's snapshots into a top-bar menu: browse, compare, restore single files, roll back, and hand you the root command instead of taking it.
A GPL-3.0 GUI and JavaScript runtime for the ESP32: flash the board once, then install and update apps from an on-device store, on a machine with about 90 KB of RAM to spare.
The September update modernises the desktop with an icon dock, a full-screen launcher and a rebuilt Control Centre, all optional. The same week, the two-year-old firmware lock on RAM upgrades resurfaced because memory prices keep climbing.
An early alpha for the M4 Mac mini from two developers who forked from Asahi over its LLM policy: KDE on Wayland, working GPU acceleration, and Assisted-By trailers on the kernel commits.
The HID++ support merged for 7.3 is coming back out: the receiver cannot say which device sent an event, and userspace settings fight the new defaults. The revert is queued for the 7.3 fixes branch.
Anaconda gains a Stratis option: pools and filesystems through Cockpit, plus stratispool and stratisfs for kickstart installs. Caching and passphrase-free encryption still wait for post-install.
Raspberry Pi's walkthrough runs Cactus's Needle 2 on a Pi 5's CPU: 'turn the LED on' becomes code in 78 milliseconds, with no AI HAT and no cloud call in the loop.
The new Mini keeps JetKVM's web interface, cloud and open firmware in a 42 mm aluminium case: $39 wired, $42 wireless, $33 a unit in threes, using an ESP32-P4X where the original needed a Linux system.
AGPL-3.0, five containers, your own model keys, and an approval card in front of every update or delete an agent wants to make.
Upcoming ISOs shift from Xorg to the maintained X11 fork, with no near-term Wayland plans. The last distro to try this lost a maintainer over it.
The upgrade notes for 262 are mostly a breaking-change list: services that neither catch nor block `ReloadSignal=` now fail to start, and TPM-sealed credentials are pinned to the SRK.
A rootless sandbox shaped like a virtualenv: its own home, its own namespaces, no capabilities, built for coding agents run with `--dangerously-skip-permissions`.
EEPROM 2026-05-11 stops a Raspberry Pi 5 booting when the memory it finds does not match the memory it expects, and the halt happens before the OS loads, so the fix is a recovery image and a downgrade.
Ubuntu 26.10 gives critical desktop services a lower OOM score and disables systemd-oomd's session kill, so memory pressure takes out applications instead of the desktop session.
Vincent Bernat replaced log analysis with self-hosted GoatCounter and a client that only counts after a real interaction, which cut a reported 2,000 daily visitors down to fewer than 200 people.
Umbrel's biggest update to its home-server OS adds multiple users, a Photos app, iOS and Mac apps, GPU support, an MCP server for AI agents, and a Storage Manager with RAID.
