Michael Soto

I'm a senior content strategist & technical writer working for Elest.io. I turn complex self-hosted solutions into clear, actionable guides. 7 years crafting developer content. Coffee-fueled, deadline-ready, obsessed with finding the right words.

Penpot

Penpot 2.19: What to Check Before You Upgrade

Penpot 2.19.0 shipped on November 9, 2026 (2.19.1 followed a day later), with configurable keyboard shortcuts, per-side stroke widths and better path editing. For most teams it's a normal update. For two groups it isn't: anyone running a large instance, and

RAGFlow

RAGFlow 1.0: What's New and How to Upgrade from 0.x

RAGFlow 1.0 shipped on November 6, 2026, after three release candidates. It isn't a normal major version. The team rewrote the whole backend in Go, swapped out parts of the stack, and made the upgrade from 0.x a one-way trip. The migration guide says so

Zabbix

Zabbix 8.0 LTS: What's New and How to Upgrade from 7.0

Zabbix 8.0 LTS shipped on November 5, 2026, and Zabbix calls it its "most significant release yet." If you're on 7.0 LTS, you don't have to move this week: 7.0 gets full support until June 30, 2027. You do want a

Catalog Updates

Elestio Catalog Updates: 142 New Releases This Week (November 1-7, 2026)

142 stable releases landed across 52 services in the Elestio catalogue between 1 and 7 November. Nine of them fix security issues, one identity provider shipped more CVE fixes in a single patch than most projects do in a year, and two projects went to a new major version. Start

PostgreSQL

PostgreSQL 14 End of Life: How to Upgrade to 18 in Docker

PostgreSQL 14 gets its last update on November 12, 2026. The project's versioning policy lists that as the end-of-life date, and the minor release scheduled for the same day will be the final 14.x. Once it ships, no new fixes reach 14, security ones included.

Weekly

Self-Hosted Weekly: Week 45, 2026. 948 Kernel Exploits, Keycloak, WordPress KEV

OpenAI says one automated run produced working root exploits for 948 Linux kernel bugs, and most of the fixes haven't landed yet. Keycloak shipped 33 CVE fixes in a single patch release, and WordPress made CISA's exploited list. If you were hoping for a quiet week

Wiki.js

Wiki.js 3: What Changed and How to Migrate from 2.x

If you run Wiki.js 2.x, there's one thing to know before you touch anything: Wiki.js 3 can't be installed over your existing wiki. The first stable 3.0 release landed on November 1, 2026, and the project calls it "a complete rewrite

RustDesk

RustDesk Server: A Self-Hosted TeamViewer Alternative

Remote support has an awkward setup: you pay a vendor so your staff can get onto your own computers, and every session starts on infrastructure you don't control. For a small team doing a handful of support calls a day, that's a strange thing to pay

PeerTube

How to Self-Host PeerTube, a Federated YouTube Alternative

Here's an odd fact about our own blog: after more than 600 articles about self-hosted software, we've never written a single one about PeerTube. It's one of the best-known projects in the fediverse, and it answers a question plenty of teams ask

MariaDB

How to Upgrade MariaDB 10.6 to 11.8: Pre-Upgrade Checklist

Everyone notices when an update breaks something. Nobody notices when their database quietly stops getting security fixes. The second problem is worse, and right now it applies to every MariaDB 10.6 server out there. Anna Widenius, CEO of the MariaDB Foundation, just published Still on MariaDB 10.6? Why

Catalog Updates

Elestio Catalog Updates: 174 New Releases This Week (October 25-31, 2026)

174 stable releases landed across 52 services in the Elestio catalogue between 25 and 31 October. Two of them patched the same bug in two different databases on the same day, and the most interesting security fix of the week was not in the application at all. Start with the

Self-Hosted Weekly

Self-Hosted Weekly: Week 44, 2026. Brotli Hits KEV, HACS Absorbed, Forgejo Patches

A compression library you have never configured, patched in private eight months ago, is now on CISA's actively-exploited list and sitting inside half your stack. Elsewhere, the tools that move your code had a rough week, and Home Assistant is about to absorb the add-on store

PostgreSQL

PgBouncer vs Odyssey vs PgDog: Which Postgres Pooler?

Everyone thinks they know what a PostgreSQL connection pooler is for: making the database faster. We spent a day deploying three of them against an identical database and taking 104 measurements on a 4 vCPU, 8 GB machine on 8 September 2026. The first thing we found is that the

Self-Hosted

Self-Host Imagor: Resize Images Straight from the URL

You upload a 4 MB photo from a decent camera. Someone opens the page on a phone over patchy 4G, and you send them all 4 MB of it so their browser can scale it down to 400 pixels wide. The usual fix is to generate thumbnails at upload time.

Catalog Updates

Elestio Catalog Updates: 166 New Releases This Week (October 18-24, 2026)

One hundred and sixty-six stable releases shipped across 66 services in the Elestio catalog between October 18 and October 24. Many of them were fixes for two incidents: the eMudhra certificate authority keys that turned out to be guessable, and the PHP2Shell flaws in PHP itself. Several of the

Self-Hosted Weekly: Week 43, 2026. PHP2Shell, eMudhra Keys, GitLab Again

This week, most of the damage came from code your app depends on rather than the app itself. A pair of bugs in PHP's own core let attackers in without logging in, and the fixes shipped a day early after a leak. Eight certificate authority keys turned out

Security

Critical PHP RCE (CVE-2026-109618): Updating on Elestio

Last updated: 23 October 2026. All Elestio-built PHP images, including WordPress, Nextcloud, Moodle and GLPI, have been rebuilt on patched PHP and are available as updates in your dashboard. Services that run on the vendor's official image, such as Drupal, Matomo and Mautic, pick up the vendor&

AI

Chrome DevTools MCP + Ubuntu Desktop: Watch Your Agent Work

Run your AI agent in a real Chrome on Ubuntu Desktop, with your extensions and logins, and watch it live so you can take over at 2FA or CAPTCHA.

Announcement

OVHcloud Is Now on Elestio: 35 Regions, 50% Off at Launch

OVHcloud is now a cloud provider on Elestio: 35 regions including 20 Local Zones, 400+ managed open-source services, and 50% off all OVH resources until January 1, 2027.

AI

Kestra vs Airflow: Which Should Your AI Agent Trigger?

Kestra 2.0 vs Airflow 3.3 for AI agents: built-in MCP server and opt-in tools vs a REST API you guard yourself. Auth, permissions, approvals and pricing compared.

AI

Maxun + MCP: Give Your AI Agent Scraping Robots

Record a Maxun scraping robot once, then let your AI agent replay it over MCP. Includes an 85-line Python MCP server with an allowlist, and why one Maxun instance is one trust zone.

Catalog Updates

Elestio Catalog Updates: 143 New Releases This Week (October 11-17, 2026)

One hundred and forty-three stable releases shipped across 48 services in the Elestio catalog between October 11 and October 17. Two of this week's updates can't be rolled back without a backup: Supabase's Storage migrations and InfluxDB 3.12's catalog only

Self-Hosted Weekly: Week 42, 2026. GitLab CVSS 10, Drupal RCE, Mattermost 12

This was a patch-first week. GitLab fixed a CVSS 10 flaw that let unauthenticated users run code on the server, Drupal shipped a critical remote code execution fix, and Keycloak closed 18 CVEs in one release. Mattermost 12 landed with removals that can stop a server from starting, and

S3 Storage for AI Agents: Scoped Keys, Undo and Audit Log

Here's the scenario that keeps me careful: you give a research agent S3 credentials so it can save its reports. A week later, it decides to "clean up old files" and works through the whole bucket, including the customer exports your billing job writes there. Nobody

Infinidisk: Turn an S3 Bucket Into a Linux Disk

Every disk I've ever provisioned was the wrong size. Too small, and you're resizing a volume at 2 a.m. while Postgres complains about free space. Too big, and you're paying every month for 400 GB of nothing. And when the machine dies, the