backBone BriefSelf-hosting, watched and ranked. Release coverage and plain-English writing about self-hosted software.https://backbonebrief.com/enFloci runs 119 AWS services on localhost, with no account and no auth tokenhttps://backbonebrief.com/articles/floci/https://backbonebrief.com/articles/floci/An MIT-licensed local AWS emulator that answers on port 4566, with real Docker engines behind the services where fidelity matters, and sibling emulators for Azure, GCP and OCI.Sat, 26 Sep 2026 14:14:00 GMTWisp puts snapper's snapshots in the GNOME top bar, and runs nothing as roothttps://backbonebrief.com/articles/wisp/https://backbonebrief.com/articles/wisp/A GNOME Shell extension for btrfs machines that turns snapper's snapshots into a top-bar menu: browse, compare, restore single files, roll back, and hand you the root command instead of taking it.Sat, 26 Sep 2026 14:11:00 GMTKryonOS boots an ESP32 into a desktop, and its apps install over Wi-Fihttps://backbonebrief.com/articles/kryonos/https://backbonebrief.com/articles/kryonos/A GPL-3.0 GUI and JavaScript runtime for the ESP32: flash the board once, then install and update apps from an on-device store, on a machine with about 90 KB of RAM to spare.Sat, 26 Sep 2026 14:08:00 GMTPingularity keeps the receipts on your internet connectionhttps://backbonebrief.com/articles/pingularity/https://backbonebrief.com/articles/pingularity/A self-hosted dashboard that probes your connection every few seconds and runs speed tests on a schedule, keeping outages, latency, DNS and bufferbloat in a SQLite file you own.Sat, 26 Sep 2026 13:50:00 GMTKiteworks told its customers to shut down for a weekend window, with nothing to patchhttps://backbonebrief.com/articles/kiteworks/https://backbonebrief.com/articles/kiteworks/Self-managed Kiteworks systems were told to go offline for a window over the weekend after federal threat intelligence warned of an imminent attack. No compromise is known and there is no patch to apply; the customer email and the company's press release disagree on the window.Sat, 26 Sep 2026 13:45:00 GMTCARBONATO's payloads sat in an exposed Docker registry, and AI keys topped its loot listhttps://backbonebrief.com/articles/carbonato/https://backbonebrief.com/articles/carbonato/ThreatDown traced a botnet through its own unauthenticated registry, recovered the implants, and found an agent persona that ranks AI API keys above every other secret on the host.Sat, 26 Sep 2026 13:20:00 GMTNginx Proxy Manager 2.16.0 adds a logs viewer and per-path access lists, with a certbot warning attachedhttps://backbonebrief.com/articles/nginx-proxy-manager-2-16/https://backbonebrief.com/articles/nginx-proxy-manager-2-16/First release since June: a logs viewer and per-path access lists headline, a security batch underneath, and the bundled certbot bump comes with a warning for DNS plugin users.Sat, 26 Sep 2026 13:15:00 GMTStirling-PDF 3.0 adds the Processor, and a licence line at 1,000 PDFs a monthhttps://backbonebrief.com/articles/stirling-pdf-3-0/https://backbonebrief.com/articles/stirling-pdf-3-0/Version 3.0 turns batch work into pipelines that watch folders, FTP and S3, keeps the AI features optional, and draws the free line for automated processing at 1,000 PDFs a month.Sat, 26 Sep 2026 13:10:00 GMTF-Droid 2.0 rebuilds the client around three tabs, and updates now run themselveshttps://backbonebrief.com/articles/f-droid-2/https://backbonebrief.com/articles/f-droid-2/The largest update in a decade replaces the navigation, redesigns Discover, and uses Android's pre-approval install API. The post is candid about what did not come back.Sat, 26 Sep 2026 13:05:00 GMTSamba 4.25.0 switches to AES-only enctypes and ships persistent handles as experimentalhttps://backbonebrief.com/articles/samba-4-25/https://backbonebrief.com/articles/samba-4-25/The first stable of the 4.25 series makes AES the default key set on modern domains, fixing CVE-2026-20833, and offers SMB3 persistent handles with an unusually direct cost list.Sat, 26 Sep 2026 13:00:00 GMTThe Terraform registry has malware now, and it stays asleep until one hash matcheshttps://backbonebrief.com/articles/terraform-registry/https://backbonebrief.com/articles/terraform-registry/Aikido found a Go implant in two registry providers and two Go modules. It does nothing unless the SHA256 of two Terraform variables hits one value, then runs a remote-access tool with Slack and Ethereum command channels. Both providers were still listed on Wednesday night.Thu, 24 Sep 2026 01:20:00 GMTRaspberry Pi OS gets a dock and a launcher, and nothing changes unless you ask for ithttps://backbonebrief.com/articles/pi-os-refresh/https://backbonebrief.com/articles/pi-os-refresh/The September update modernises the desktop with an icon dock, a full-screen launcher and a rebuilt Control Centre, all optional. The same week, the two-year-old firmware lock on RAM upgrades resurfaced because memory prices keep climbing.Thu, 24 Sep 2026 01:15:00 GMTGravity Linux is a Fedora remix for Apple Silicon that plans to sunset itselfhttps://backbonebrief.com/articles/gravity-linux/https://backbonebrief.com/articles/gravity-linux/An early alpha for the M4 Mac mini from two developers who forked from Asahi over its LLM policy: KDE on Wayland, working GPU acceleration, and Assisted-By trailers on the kernel commits.Thu, 24 Sep 2026 01:10:00 GMTJev returns decisions instead of prose, and the local version is 25 lines of Pythonhttps://backbonebrief.com/articles/jev/https://backbonebrief.com/articles/jev/TypeSafe's decision model charges $0.042 per million input tokens with free output; a parody post and two open rewrites show the trick runs on any GGUF model, and a coin-flip test shows where the numbers get shaky.Wed, 23 Sep 2026 15:40:00 GMTHolaOS is an agent workspace you run yourself, under a licence that says do not sell it as a servicehttps://backbonebrief.com/articles/holaos/https://backbonebrief.com/articles/holaos/11.3k stars, one-line install on macOS, Linux or WSL, apps running beside the agent and memory kept as plain files. The modified Apache 2.0 licence is the part to read before you standardise on it.Wed, 23 Sep 2026 15:35:00 GMTLinux 7.3 is reverting its new Logitech Bolt support after the scroll wheels went crazyhttps://backbonebrief.com/articles/logitech-bolt/https://backbonebrief.com/articles/logitech-bolt/The HID++ support merged for 7.3 is coming back out: the receiver cannot say which device sent an event, and userspace settings fight the new defaults. The revert is queued for the 7.3 fixes branch.Wed, 23 Sep 2026 15:30:00 GMTFedora 45's installer can build root and home on Stratis nowhttps://backbonebrief.com/articles/fedora-stratis/https://backbonebrief.com/articles/fedora-stratis/Anaconda gains a Stratis option: pools and filesystems through Cockpit, plus stratispool and stratisfs for kickstart installs. Caching and passphrase-free encryption still wait for post-install.Wed, 23 Sep 2026 15:25:00 GMTOpus 5.5 and GPT-6 Sol and Luna both cut their prices, ten days after a call to slow the frontierhttps://backbonebrief.com/articles/frontier-pricing/https://backbonebrief.com/articles/frontier-pricing/Anthropic and OpenAI shipped cheaper flagships on Tuesday, and Anthropic's own announcement says Opus 5.5 is the first release since the pacing essay.Wed, 23 Sep 2026 02:54:05 GMTTechnitium 15.5 patches nine vulnerabilities, three from Palo Alto Networkshttps://backbonebrief.com/articles/technitium-15-5/https://backbonebrief.com/articles/technitium-15-5/The DNS server's release notes read like an advisory first: nine vulnerability fixes, most credited to outside researchers, with LDAP logins and a zone file editor alongside.Wed, 23 Sep 2026 01:45:00 GMTTrueNAS's Proxmox plugin automates the storage wiring you used to do by handhttps://backbonebrief.com/articles/truenas-proxmox-plugin/https://backbonebrief.com/articles/truenas-proxmox-plugin/A native Proxmox storage backend turns VM disk requests into zvols on the array, delivers OpenZFS snapshots over iSCSI or NVMe/TCP, and ships now as an Early Adopters release, Community Edition first.Wed, 23 Sep 2026 01:35:00 GMTSeerr: the unified Jellyfin–Plex–Emby request manager, seven months onhttps://backbonebrief.com/articles/seerr/https://backbonebrief.com/articles/seerr/Jellyseerr and Overseerr merged into one project in February; since then Seerr has ended its feature freeze, patched a critical security release, and kept a steady preview train; the newest branch reworks authentication around OpenID Connect.Wed, 23 Sep 2026 01:25:00 GMTNeedle 2 turns plain English into local actions on a Raspberry Pi 5https://backbonebrief.com/articles/needle-2-raspberry-pi/https://backbonebrief.com/articles/needle-2-raspberry-pi/Raspberry Pi's walkthrough runs Cactus's Needle 2 on a Pi 5's CPU: 'turn the LED on' becomes code in 78 milliseconds, with no AI HAT and no cloud call in the loop.Wed, 23 Sep 2026 01:15:00 GMTJetKVM Mini is a $39 matchbox KVM, and it ships October 26https://backbonebrief.com/articles/jetkvm-mini/https://backbonebrief.com/articles/jetkvm-mini/The new Mini keeps JetKVM's web interface, cloud and open firmware in a 42 mm aluminium case: $39 wired, $42 wireless, $33 a unit in threes, using an ESP32-P4X where the original needed a Linux system.Wed, 23 Sep 2026 01:05:00 GMTEvery Unbound through 1.26.0 has a heap overflow in its DNSSEC validatorhttps://backbonebrief.com/articles/unbound-dnssec-validator/https://backbonebrief.com/articles/unbound-dnssec-validator/A DNSKEY whose owner pointer compresses into its own RDATA overflows the digest buffer; the advisory rates it denial of service and possible remote code execution, and 1.26.1 fixes it.Wed, 23 Sep 2026 00:45:00 GMTForgejo closes a patch-apply RCE that the last fix missedhttps://backbonebrief.com/articles/forgejo-16-0-5/https://backbonebrief.com/articles/forgejo-16-0-5/v16.0.5 and v15.0.9, both out 17 September, patch a critical RCE reached by applying a patch, plus a CSRF that could attach an unexpected OpenID identity to a logged-in account.Wed, 23 Sep 2026 00:35:00 GMTCrowdSec's private repos left through an access it kept open, and a breach forum told ithttps://backbonebrief.com/articles/crowdsec-tanstack/https://backbonebrief.com/articles/crowdsec-tanstack/Nine minutes of downloads in May, four months of quiet, and an incident report that names the kept-alive account and the compromised laptop behind it.Wed, 23 Sep 2026 00:25:00 GMTDuplicati 2.4.0.0 will refuse a data folder it does not trusthttps://backbonebrief.com/articles/duplicati-2-4-0/https://backbonebrief.com/articles/duplicati-2-4-0/The new stable treats the data folder's permissions as a hard requirement: exact permissions or it will not run, with three documented ways out for the setups that cannot comply.Wed, 23 Sep 2026 00:15:00 GMTProxmox VE is officially on ARM64, and the ecosystem is the missing halfhttps://backbonebrief.com/articles/proxmox-arm64/https://backbonebrief.com/articles/proxmox-arm64/PVE 9.2 for arm64 shares the codebase and release cycle with x86-64; the hands-on reports agree the platform works and the tools around it still lag.Wed, 23 Sep 2026 00:05:00 GMTTigerGraph's default container gives away SSH access, and the vendor has no fix outhttps://backbonebrief.com/articles/tigergraph/https://backbonebrief.com/articles/tigergraph/Four default settings in tigergraph/community:latest compose into command execution as the database's own service account, using no secret that is not already public.Tue, 22 Sep 2026 13:45:00 GMTRelaticle is a self-hosted CRM where the AI proposes and you approvehttps://backbonebrief.com/articles/relaticle/https://backbonebrief.com/articles/relaticle/AGPL-3.0, five containers, your own model keys, and an approval card in front of every update or delete an agent wants to make.Tue, 22 Sep 2026 13:40:00 GMTPeppermintOS moves its ISOs to XLibre, the fork for people staying on X11https://backbonebrief.com/articles/peppermintos-xlibre/https://backbonebrief.com/articles/peppermintos-xlibre/Upcoming ISOs shift from Xorg to the maintained X11 fork, with no near-term Wayland plans. The last distro to try this lost a maintainer over it.Tue, 22 Sep 2026 13:35:00 GMTSandopolis is a Sega emulator in Zig, and it serves itself to your LAN in one containerhttps://backbonebrief.com/articles/sandopolis/https://backbonebrief.com/articles/sandopolis/MIT-licensed, alpha, five Sega systems, a Libretro core and a browser build you can run from ghcr.io with one docker run.Tue, 22 Sep 2026 13:30:00 GMTWordPress 7.1.2 fixes an unauthenticated path traversal that ends in code executionhttps://backbonebrief.com/articles/wordpress-page-template/https://backbonebrief.com/articles/wordpress-page-template/The bug needs a theme with a top-level `page-` directory and a readable local `.php` file, and the official PHP Docker image supplies the second half.Tue, 22 Sep 2026 13:15:00 GMTGit 3.0's breaking changes are now written down, and there is still no datehttps://backbonebrief.com/articles/git-3-0/https://backbonebrief.com/articles/git-3-0/New repositories will default to SHA-256, reftable and the branch name `main`, Rust becomes a required part of the build, and the last 2.x ships as a long-term support release.Tue, 22 Sep 2026 13:10:00 GMTwalkytalky is self-hosted, and self-hosting means your own Firebase projecthttps://backbonebrief.com/articles/walkytalky/https://backbonebrief.com/articles/walkytalky/An MIT-licensed iOS chat app with real end-to-end encryption and no service behind it. The data plane is Firebase, and the account, the rules and the console are Google's.Tue, 22 Sep 2026 13:05:00 GMTsystemd 262 fails a notify-reload service that ignores its reload signalhttps://backbonebrief.com/articles/systemd-262/https://backbonebrief.com/articles/systemd-262/The upgrade notes for 262 are mostly a breaking-change list: services that neither catch nor block `ReloadSignal=` now fail to start, and TPM-sealed credentials are pinned to the SRK.Tue, 22 Sep 2026 13:00:00 GMTTailscale is replacing the one-lane path through subnet routershttps://backbonebrief.com/articles/tailscale-multiqueue/https://backbonebrief.com/articles/tailscale-multiqueue/Subnet routers, app connectors and exit nodes run every stream through a single ordered pipeline today; multi-queue lands after v1.104, and netmap caching comes first.Tue, 22 Sep 2026 12:45:00 GMTDrop gives an untrusted program a user namespace instead of a containerhttps://backbonebrief.com/articles/drop-sandbox/https://backbonebrief.com/articles/drop-sandbox/A rootless sandbox shaped like a virtualenv: its own home, its own namespaces, no capabilities, built for coding agents run with `--dangerously-skip-permissions`.Tue, 22 Sep 2026 12:30:00 GMTEpure keeps the Sentry SDKs and cuts self-hosted error monitoring to two containershttps://backbonebrief.com/articles/epure/https://backbonebrief.com/articles/epure/Exception-only error monitoring over Postgres 16: change the DSN, get grouped issues, and watch transactions, replay and profiles get dropped at the door.Tue, 22 Sep 2026 12:15:00 GMTAn npm maths library that only wakes up when you solve the right equationhttps://backbonebrief.com/articles/mathmain-npm-loader/https://backbonebrief.com/articles/mathmain-npm-loader/mathmain ships an encrypted implant that stays dormant until a caller passes one specific matrix to its solver, and the code is missing from the GitHub repository the package links to.Tue, 22 Sep 2026 12:00:00 GMTVMs that keep running while the host kernel is replacedhttps://backbonebrief.com/articles/orphaned-vms/https://backbonebrief.com/articles/orphaned-vms/A 46-patch RFC keeps KVM guests executing on shielded physical CPUs through a host kexec, under a small privileged layer that services their exits while no host kernel and no VMM exist.Tue, 22 Sep 2026 11:45:00 GMTSelf-hosting behind carrier NAT, with a VPS as the bridgehttps://backbonebrief.com/articles/cgnat-wireguard-bridge/https://backbonebrief.com/articles/cgnat-wireguard-bridge/A machine behind carrier-grade NAT reached through a cheap VPS and a WireGuard tunnel, with the home side initiating, the routing split so replies go down the tunnel, and the measured cost in latency.Tue, 22 Sep 2026 11:30:00 GMTA voice agent in one process, with the latency numbers publishedhttps://backbonebrief.com/articles/fusion-runtime/https://backbonebrief.com/articles/fusion-runtime/fusion-runtime runs speech recognition, an LLM and speech synthesis in one process, and its benchmark section publishes the number that makes it look worse and explains why the stages do not add up.Tue, 22 Sep 2026 11:15:00 GMTA Pi 5 EEPROM update stops boards whose SDRAM the bootloader does not expecthttps://backbonebrief.com/articles/pi5-eeprom-sdram/https://backbonebrief.com/articles/pi5-eeprom-sdram/EEPROM 2026-05-11 stops a Raspberry Pi 5 booting when the memory it finds does not match the memory it expects, and the halt happens before the OS loads, so the fix is a recovery image and a downgrade.Mon, 21 Sep 2026 14:00:00 GMTHomebrew 7.0.0 adds a vulnerability scanner and drops Intel Macs to Tier 3https://backbonebrief.com/articles/homebrew-7/https://backbonebrief.com/articles/homebrew-7/Homebrew 7.0.0 ships brew vulns for checking installed packages against an in-house advisory database, fixes eight advisories, sandboxes installs, and moves Intel Macs to Tier 3 with no new bottles.Mon, 21 Sep 2026 13:45:00 GMTCambium is in administration, and cnMaestro Cloud has a date on ithttps://backbonebrief.com/articles/cambium-cnmaestro/https://backbonebrief.com/articles/cambium-cnmaestro/Cambium Networks Limited entered administration on 14 September, cnMaestro Cloud is only promised to run through 1 October, and the recommended migration to on-premises still needs an account on the same cloud.Mon, 21 Sep 2026 13:30:00 GMTUbuntu 26.10 kills your applications before it kills your sessionhttps://backbonebrief.com/articles/ubuntu-26-10-oom/https://backbonebrief.com/articles/ubuntu-26-10-oom/Ubuntu 26.10 gives critical desktop services a lower OOM score and disables systemd-oomd's session kill, so memory pressure takes out applications instead of the desktop session.Mon, 21 Sep 2026 13:15:00 GMTGoatCounter counted 200 humans where GoAccess counted 2,000 visitorshttps://backbonebrief.com/articles/goatcounter-analytics/https://backbonebrief.com/articles/goatcounter-analytics/Vincent Bernat replaced log analysis with self-hosted GoatCounter and a client that only counts after a real interaction, which cut a reported 2,000 daily visitors down to fewer than 200 people.Mon, 21 Sep 2026 13:05:00 GMTPortainer 3.0 goes Kubernetes-first, and Docker support stays where it ishttps://backbonebrief.com/articles/portainer-3-0/https://backbonebrief.com/articles/portainer-3-0/Portainer 3.0 rebuilds the product around Kubernetes. Community Edition stays on 2.x, Docker environments keep working but stop growing, and the recommended path out is a Docker-to-Kubernetes translator.Mon, 21 Sep 2026 00:45:00 GMTNextcloud Hub 26 Summer ships as Server 35, with Office heading to the desktophttps://backbonebrief.com/articles/nextcloud-hub-26/https://backbonebrief.com/articles/nextcloud-hub-26/Nextcloud Hub 26 Summer is out as Server 35.0.0, with a Euro-Office desktop client, team workspaces, a redesigned Photos app and one-time passwords for shares, while Hub 25 Autumn goes end of life.Mon, 21 Sep 2026 00:30:00 GMTFrigate 0.18.0: the config moves into the UI and the annotated JPEGs go awayhttps://backbonebrief.com/articles/frigate-0-18/https://backbonebrief.com/articles/frigate-0-18/Frigate 0.18.0 is the first stable of the 0.18 line, bringing full UI configuration, profiles, a GenAI chat agent and rebuilt exports, with a config migration, a WebP-only snapshot change and an FFmpeg 8 trap in go2rtc.Mon, 21 Sep 2026 00:15:00 GMTImmich 3.2 rebuilds search and recognises people across accountshttps://backbonebrief.com/articles/immich-3-2/https://backbonebrief.com/articles/immich-3-2/Immich 3.2.0 lands a new search API and cross-user face grouping that requires a facial recognition reset, and drew two hotfixes in the five days after release.Mon, 21 Sep 2026 00:00:00 GMTGrafana patches a plugin-archive RCE and a Geomap XSS in four releaseshttps://backbonebrief.com/articles/grafana-security/https://backbonebrief.com/articles/grafana-security/Grafana's 15 September releases — 12.4.11, 13.0.9, 13.1.6 and 13.2.2, one per branch — fix a plugin-extraction path traversal that can run code as the Grafana server, plus a Geomap stored XSS.Sun, 20 Sep 2026 23:45:00 GMTJellyfin 12.1 is a bugfix release, and several fixes land on the 12.0 upgradehttps://backbonebrief.com/articles/jellyfin-12-1/https://backbonebrief.com/articles/jellyfin-12-1/Jellyfin 12.1 is 47 fixes six days after 12.0, and several of them touch the migration and the pre-migration backup.Sun, 20 Sep 2026 23:30:00 GMTTailcat is netcat over Tailscale's data plane, with no account and no control planehttps://backbonebrief.com/articles/tailcat/https://backbonebrief.com/articles/tailcat/Tailscale open-sourced tailcat, a netcat-like CLI and Go library that connects two machines over the same WireGuard and NAT-traversal stack as Tailscale, without an account, a control plane or any IP addresses.Sun, 20 Sep 2026 23:15:00 GMTumbrelOS 2.0 arrives September 22 with multiple users and RAID storagehttps://backbonebrief.com/articles/umbrelos-2-0/https://backbonebrief.com/articles/umbrelos-2-0/Umbrel's biggest update to its home-server OS adds multiple users, a Photos app, iOS and Mac apps, GPU support, an MCP server for AI agents, and a Storage Manager with RAID.Sun, 20 Sep 2026 23:00:00 GMTJellyfin 12.0: modern on the surface, rebuilt underneathhttps://backbonebrief.com/articles/jellyfin-12-0/https://backbonebrief.com/articles/jellyfin-12-0/Jellyfin 12.0 makes its Modern layout the default and rebuilds how playlists and collections are stored — and it rewrites your database on first boot, so the backup is the only way back.Sun, 20 Sep 2026 22:45:00 GMT