GuidesSelf-hosting behind carrier NAT, with a VPS as the bridge22 SepA machine behind carrier-grade NAT reached through a cheap VPS and a WireGuard tunnel, with the home side initiating, the routing split so replies go down the tunnel, and the measured cost in latency.
From 10 February 2027 Let's Encrypt issues 64-day certificates by default, with the last 90-day certificate expiring on 11 May 2027 and no revocation of what is already out there. Clients that follow ACME Renewal Info handle it; hard-coded offsets need to move to about two thirds of the lifetime, and a third-party test in October found one acme.sh version scheduling its renewal after the certificate had already expired.
Tailscale shipped v1.104.4 on 28 October with fixes for privilege-boundary bugs in Tailscale SSH and three Serve bugs. The flaws were about what a session could do after it was authorised, not who could connect, and Tailscale argues the 'Tailworm' framing overstates them: exploitation needs an existing foothold in the tailnet and SSH permitted by policy.
Stalwart, the self-hosted mail and collaboration server, announced v1.0 on 26 October. The release finalises the database schema so upgrades stop being migrations, rewrites full-text search with phrase matching and indexing inside PDFs and office documents, and publishes the project's own benchmarks against Postfix and Dovecot.
wg-easy v15.5.0, published 24 October, carries Node.js runtime updates the project describes as fixing some Node.js vulnerabilities, linking Node's October advisory, plus AmneziaWG 3.1 support, trusted-proxy handling and a promised configurable interface name.
ntfy v2.33.1 rebuilds the service with Go 1.27.3 so certificate chains through the compromised eMudhra intermediates are rejected, adds per-peer and database pool metrics for its experimental cluster, and fixes the crash that hit older CPUs in 2.33.0. Take 2.33.1, not 2.33.0.
Two days after v2.31.0 fixed messages lost on reconnect, ntfy ships the fix for the database overload that followed on ntfy.sh: an index that makes since= reconnects cheap again, friendlier schema handling for rollbacks, and exact upgrade notes.
The security release fixes four high-severity advisories and one low, all paths that turn a foothold as the pihole service account or its configuration surfaces into root, and ships hardening that includes a gravity schema migration; every affected version is patched in 6.5.
An HTTP/2 proxy crash, streams cut off after a minute of quiet, empty cookie placeholders: the follow-up patch is out less than two days later, with the new Incremental header as the feature.
Exit nodes send a client's whole internet connection out through a chosen site, while the desktop and phone clients get on-demand tunnel activation, a rebuilt UI, and a subnet router for Linux.
The beta channel moves from 0.108.0-b.91 to the project's first 1.0.0 build, bringing the new UI, a Go security bump, four small fixes, and the end of macOS 13 support.
The first release since June carries fixes for a url_pattern authorization bypass, an HTTPoxy hole in FastCGI, slowloris exposure, a sticky-session timing side channel and a Windows path bypass, plus new matcher and header options.
The point release carries a low-severity fix for a password-policy lock that an empty Save could clear, moves the default hash from bcrypt to argon2id (optional, existing hashes keep working), and takes the outbound NAT page to the legacy plugin without breaking rules.
Seven days after the nine-fix 15.5 release, the follow-up patches a session-token prefix oracle that let a low-privilege user recover any active session's full token, a logs-view XSS, and a recursive-resolver regression that broke resolution for some domains.
A self-hosted dashboard that probes your connection every few seconds and runs speed tests on a schedule, keeping outages, latency, DNS and bufferbloat in a SQLite file you own.
First release since June: a logs viewer and per-path access lists headline, a security batch underneath, and the bundled certbot bump comes with a warning for DNS plugin users.
The DNS server's release notes read like an advisory first: nine vulnerability fixes, most credited to outside researchers, with LDAP logins and a zone file editor alongside.
A DNSKEY whose owner pointer compresses into its own RDATA overflows the digest buffer; the advisory rates it denial of service and possible remote code execution, and 1.26.1 fixes it.
Subnet routers, app connectors and exit nodes run every stream through a single ordered pipeline today; multi-queue lands after v1.104, and netmap caching comes first.
Cambium Networks Limited entered administration on 14 September, cnMaestro Cloud is only promised to run through 1 October, and the recommended migration to on-premises still needs an account on the same cloud.
Tailscale open-sourced tailcat, a netcat-like CLI and Go library that connects two machines over the same WireGuard and NAT-traversal stack as Tailscale, without an account, a control plane or any IP addresses.
