Self-Hosted Weekly: Week 30, 2026. ServiceNow RCE, GitHub's $100M, Logseq 2.0
Another week, another reminder that self-hosting is equal parts freedom and responsibility. This week brought a nasty pre-auth exploit making the rounds, a community funding milestone with an asterisk, and a beloved note-taking app deciding to split itself in two. Grab a coffee. Here are the eight stories that mattered.
1. ServiceNow pre-auth RCE is being exploited in the wild
The big one. CVE-2026-6875 is a critical pre-authentication flaw in the ServiceNow AI Platform that lets an unauthenticated attacker escape the script sandbox and run code remotely. Exploitation started around July 17, days after the self-hosted patch shipped, and attackers are specifically hunting instances that have not updated yet.
Hot take: "Patch available" and "patch applied" are two very different states, and attackers live in the gap between them. If you run anything internet-facing, the July 13 update is not optional. This is the exact scenario where managed hosting with automatic patching earns its keep.
2. GitHub Sponsors crossed $100M, and maintainers are still broke
GitHub announced that more than $100 million has now flowed through Sponsors to open-source maintainers. Great headline. The same week, Help Net Security reported that critical projects keep losing maintainers to salaried jobs, and security fixes slow down when they leave.
Hot take: $100 million sounds huge until you divide it across the entire dependency tree of modern software. The projects you rely on for free are often maintained by one exhausted person. If your company self-hosts open source, sponsoring the tools you depend on is not charity, it is supply-chain insurance.
3. Kubernetes v1.37 will require containerd 2.0
v1.37 is targeted for August 26, and it carries a hard requirement: containerd 2.0 or later. If your nodes are still on the 1.x line, the upgrade will not go the way you hope.
Hot take: This is the kind of dependency bump that quietly breaks clusters at 2am. Check your container runtime version this weekend, not on upgrade day.
4. Docker Desktop's July update fixes the annoying stuff
The July release is a stability pass rather than a feature drop. The highlight for Windows users: you can now migrate a per-machine install to a per-user install in place, without uninstalling and losing your data. It also fixes kubectl exec and kubectl attach for v1.36.
Hot take: Boring releases are underrated. Nobody tweets about "we fixed the installer," but those are the fixes that stop eating your afternoon.
5. Mozilla published "The State of Open Source AI v1"
Mozilla released the first edition of a report mapping where open-source AI actually stands, from open weights to tooling to the murky definitions of "open" in the model world.
Hot take: We badly need a shared vocabulary here. "Open source AI" currently means anything from fully reproducible training to "you can download the weights, please do not ask questions." A credible baseline document is overdue.
6. Germany opens more procurement doors for open source
New German procurement rules are making it easier for public bodies to choose open-source software over proprietary lock-in.
Hot take: Sovereignty is quietly becoming the strongest sales pitch open source has. When a government writes "prefer open source" into its buying rules, that is a bigger long-term win than any single product launch.
7. Logseq shipped a v2.0 beta and split into two versions
Logseq dropped its v2.0 beta and announced the project is being split into two versions. A ground-up rewrite is a big swing for a tool people trust with years of notes.
Hot take: Rewrites are where beloved apps either level up or lose their community. I am cautiously optimistic, but if you self-host Logseq, keep your Markdown exports handy before you touch the beta.
8. Pocket ID and Tinyauth are now OpenID Connect certified
Two lightweight self-hosted auth projects, Pocket ID and Tinyauth, both earned official OpenID Connect certification.
Hot take: Certification is a trust signal that matters more than stars. Auth is the one place where "it mostly works" is not good enough, so seeing small projects pass a formal conformance bar is genuinely reassuring.
What we're watching next week
- Kubernetes v1.37 release candidates as the August 26 date approaches.
- More ServiceNow exploitation activity, and whether the gadget variants spread to other sandboxed platforms.
- The next Self-Host Weekly for the release wave we did not have room for here.
The bottom line
The theme this week was maintenance, not launches. Patch your ServiceNow, check your container runtime, sponsor the projects you lean on, and back up your notes before chasing a shiny beta. Self-hosting gives you control, and control means these jobs are yours now.
If you would rather someone else handle the patching, backups, and updates while you keep full data ownership, that is exactly what Elestio does for hundreds of open-source tools.
Thanks for reading ❤️. See you next week 👋