Weekly

Self-Hosted Weekly: Week 45, 2026. 948 Kernel Exploits, Keycloak, WordPress KEV

OpenAI says one automated run produced working root exploits for 948 Linux kernel bugs, and most of the fixes haven't landed yet. Keycloak shipped 33 CVE fixes in a single patch release, and WordPress made CISA's exploited list. If you were hoping for a quiet week

Solidtime

Solidtime: Free Open Source Alternative to Toggl & Clockify

Tracking time is essential for freelancers, agencies, and businesses that need to monitor productivity, manage projects, and accurately bill their clients. However, popular time-tracking solutions like Toggl Track and Clockify can become expensive as your team grows or you need access to more advanced features. That's where

Wiki.js

Wiki.js 3: What Changed and How to Migrate from 2.x

If you run Wiki.js 2.x, there's one thing to know before you touch anything: Wiki.js 3 can't be installed over your existing wiki. The first stable 3.0 release landed on November 1, 2026, and the project calls it "a complete rewrite

RustDesk

RustDesk Server: A Self-Hosted TeamViewer Alternative

Remote support has an awkward setup: you pay a vendor so your staff can get onto your own computers, and every session starts on infrastructure you don't control. For a small team doing a handful of support calls a day, that's a strange thing to pay

PeerTube

How to Self-Host PeerTube, a Federated YouTube Alternative

Here's an odd fact about our own blog: after more than 600 articles about self-hosted software, we've never written a single one about PeerTube. It's one of the best-known projects in the fediverse, and it answers a question plenty of teams ask

MariaDB

How to Upgrade MariaDB 10.6 to 11.8: Pre-Upgrade Checklist

Everyone notices when an update breaks something. Nobody notices when their database quietly stops getting security fixes. The second problem is worse, and right now it applies to every MariaDB 10.6 server out there. Anna Widenius, CEO of the MariaDB Foundation, just published Still on MariaDB 10.6? Why

Catalog Updates

Elestio Catalog Updates: 174 New Releases This Week (October 25-31, 2026)

174 stable releases landed across 52 services in the Elestio catalogue between 25 and 31 October. Two of them patched the same bug in two different databases on the same day, and the most interesting security fix of the week was not in the application at all. Start with the

Self-Hosted Weekly

Self-Hosted Weekly: Week 44, 2026. Brotli Hits KEV, HACS Absorbed, Forgejo Patches

A compression library you have never configured, patched in private eight months ago, is now on CISA's actively-exploited list and sitting inside half your stack. Elsewhere, the tools that move your code had a rough week, and Home Assistant is about to absorb the add-on store

PostgreSQL

PgBouncer vs Odyssey vs PgDog: Which Postgres Pooler?

Everyone thinks they know what a PostgreSQL connection pooler is for: making the database faster. We spent a day deploying three of them against an identical database and taking 104 measurements on a 4 vCPU, 8 GB machine on 8 September 2026. The first thing we found is that the

Self-Hosted

Self-Host Imagor: Resize Images Straight from the URL

You upload a 4 MB photo from a decent camera. Someone opens the page on a phone over patchy 4G, and you send them all 4 MB of it so their browser can scale it down to 400 pixels wide. The usual fix is to generate thumbnails at upload time.

Loomio

Loomio: Free Open Source Decision-Making Platform for Teams & Communities

Making decisions as a team isn't always easy, especially when members are working remotely, spread across different time zones, or have different opinions on important topics. Traditional communication tools like Slack, Microsoft Teams, or email are great for conversations, but they aren't necessarily designed to help

Catalog Updates

Elestio Catalog Updates: 166 New Releases This Week (October 18-24, 2026)

One hundred and sixty-six stable releases shipped across 66 services in the Elestio catalog between October 18 and October 24. Many of them were fixes for two incidents: the eMudhra certificate authority keys that turned out to be guessable, and the PHP2Shell flaws in PHP itself. Several of the

Self-Hosted Weekly: Week 43, 2026. PHP2Shell, eMudhra Keys, GitLab Again

This week, most of the damage came from code your app depends on rather than the app itself. A pair of bugs in PHP's own core let attackers in without logging in, and the fixes shipped a day early after a leak. Eight certificate authority keys turned out

Security

Critical PHP RCE (CVE-2026-109618): Updating on Elestio

Last updated: 23 October 2026. All Elestio-built PHP images, including WordPress, Nextcloud, Moodle and GLPI, have been rebuilt on patched PHP and are available as updates in your dashboard. Services that run on the vendor's official image, such as Drupal, Matomo and Mautic, pick up the vendor&

AI

Chrome DevTools MCP + Ubuntu Desktop: Watch Your Agent Work

Run your AI agent in a real Chrome on Ubuntu Desktop, with your extensions and logins, and watch it live so you can take over at 2FA or CAPTCHA.

Announcement

OVHcloud Is Now on Elestio: 35 Regions, 50% Off at Launch

OVHcloud is now a cloud provider on Elestio: 35 regions including 20 Local Zones, 400+ managed open-source services, and 50% off all OVH resources until January 1, 2027.

AI

Kestra vs Airflow: Which Should Your AI Agent Trigger?

Kestra 2.0 vs Airflow 3.3 for AI agents: built-in MCP server and opt-in tools vs a REST API you guard yourself. Auth, permissions, approvals and pricing compared.

AI

Maxun + MCP: Give Your AI Agent Scraping Robots

Record a Maxun scraping robot once, then let your AI agent replay it over MCP. Includes an 85-line Python MCP server with an allowlist, and why one Maxun instance is one trust zone.

Catalog Updates

Elestio Catalog Updates: 143 New Releases This Week (October 11-17, 2026)

One hundred and forty-three stable releases shipped across 48 services in the Elestio catalog between October 11 and October 17. Two of this week's updates can't be rolled back without a backup: Supabase's Storage migrations and InfluxDB 3.12's catalog only

Open source softwares

Alexandrie: Free Open Source Markdown Notes App (Notion & Obsidian Alternative)

If you're looking for a free, open-source alternative to Notion or Obsidian that combines powerful Markdown editing, organized workspaces, and team collaboration, Alexandrie is worth exploring. Alexandrie is a modern, self-hostable note-taking and knowledge management platform designed to help individuals and teams create, organize, and

Self-Hosted Weekly: Week 42, 2026. GitLab CVSS 10, Drupal RCE, Mattermost 12

This was a patch-first week. GitLab fixed a CVSS 10 flaw that let unauthenticated users run code on the server, Drupal shipped a critical remote code execution fix, and Keycloak closed 18 CVEs in one release. Mattermost 12 landed with removals that can stop a server from starting, and

S3 Storage for AI Agents: Scoped Keys, Undo and Audit Log

Here's the scenario that keeps me careful: you give a research agent S3 credentials so it can save its reports. A week later, it decides to "clean up old files" and works through the whole bucket, including the customer exports your billing job writes there. Nobody

Infinidisk: Turn an S3 Bucket Into a Linux Disk

Every disk I've ever provisioned was the wrong size. Too small, and you're resizing a volume at 2 a.m. while Postgres complains about free space. Too big, and you're paying every month for 400 GB of nothing. And when the machine dies, the

Elestio Object Storage: S3 Buckets With No Egress Fees

Most Elestio customers I talk to have the same awkward line in their architecture diagram. The apps run on Elestio. The backups, uploads, media files and exports go to a bucket somewhere else, on a different bill, with a different set of keys, and an egress charge that shows up

PrestaShop MCP Server: Connect Claude to Your Store

It's Monday morning, a supplier just raised prices on 40 products, and every one of them has descriptions in French, English and Spanish. You know exactly what needs to change. You just don't want to spend two hours clicking through the PrestaShop back office to do