Self-Hosted Weekly: Week 32, 2026. Proxmox Arm64, Rust AI Policy, Gitea CVE

Week 32 delivered the thing the homelab crowd has wanted since the first Raspberry Pi cluster: real Arm virtualization, officially supported. It was also the week Rust told its contributors to stop letting language models write their patches, and the week a 9.8 in Gitea reminded everyone that self-hosting your Git server means you own the patch cycle too.

Here are the eight stories worth your attention.

1. Proxmox VE 9.2 Ships Official Arm64 Support

On August 5, Proxmox Server Solutions announced the first officially supported Arm64 edition of Proxmox Virtual Environment. This isn't a community port. Proxmox VE 9.2 for arm64 shares the same codebase, package repositories, and release lifecycle as the x86-64 edition, with full feature parity across KVM, LXC, ZFS, and Ceph. It's built on Debian 13.5 "Trixie" with Linux 7.0. Proxmox engineers worked with NVIDIA and Supermicro on day-one validation for Grace and Vera CPUs.

Hot take: The NVIDIA collaboration tells you who this is really for, and it isn't your Pi 5 sitting on a shelf. But the side effect is that Ampere and other Arm server boards now have a serious hypervisor with a real support lifecycle behind them. Check the hardware compatibility notes before you buy anything, because "officially supported" and "supported on your specific board" are still two different sentences.

2. Gitea Patches a 9.8 That Reads Files Off Your Server

CVE-2026-59774 landed a formal advisory on August 2, rated CVSS 9.8. An unauthenticated attacker can hit the markup rendering endpoint on any public repository, submit Org-mode markup with an #+INCLUDE directive pointing at an absolute path, and read arbitrary files that the Gitea service account can access. The root cause is Gitea initializing the go-org library without overriding its default ReadFile callback. Versions 1.22.1 through 1.27.0 are affected. Fixed in 1.27.1.

Hot take: File read is bad. The escalation path is worse. Gitea's own advisory walks through it: read app.ini, extract INTERNAL_TOKEN, inject a Git hook through the internal logger, trigger it during an anonymous clone. That's remote code execution with three extra steps. If your Gitea instance has even one public repository and a route to the internet, treat this as active. Patch first, rotate INTERNAL_TOKEN second.

3. Rust Adopts an LLM Contribution Policy

Also on August 5, five teams in the Rust project adopted a policy governing how large language models can be used when contributing to the rust-lang/rust monorepo. The line it draws is narrow and specific: LLMs are fine for reading, analyzing, summarizing, editing, checking your work, and private review. They're not fine for generating public contributions without disclosure, comprehension, and human accountability. The policy applies only to those teams in that repository, not to the Rust ecosystem broadly.

Hot take: This is the most carefully worded AI policy any major project has published, and that care is the point. It doesn't ban tools, it bans unaccountable output. Maintainer time is the scarcest resource in open source, and a plausible-looking patch the submitter can't explain burns more of it than no patch at all. Expect other large projects to copy this text almost verbatim.

4. Home Assistant 2026.8 Drops the Port Number

The August release is titled "Approachable by design," and the headline change is that new installations no longer require :8123 in the URL. The team also stripped words like "advanced" and "expert" from roughly 43 places across the app and docs, made entity IDs renameable and reorderable, and stopped merging device entries across integrations so conflicting model numbers no longer collide.

Hot take: Removing a port number sounds cosmetic until you've watched a household member give up on a dashboard because the bookmark looked broken. But the device-entry change is the one that saves you real support headaches: merged devices with conflicting metadata have quietly broken automations for years.

5. OpenVPN 2.7.6 Fixes Two CVEs

Released August 6. CVE-2026-63649 affects the Windows openvpnserv component and let users bypass administrator-defined restrictions on which directories may hold OpenVPN configuration files. CVE-2026-63650 affects mbedTLS builds, where --x509-username-field could cause OpenVPN to accept certificates it should have rejected under specific CA configurations. The release also fixed key-state synchronization with Data Channel Offload, packet-sizing errors, and VLAN traffic validation.

Hot take: Neither CVE is a five-alarm fire. The DCO key-state fixes are the real reason to upgrade: if you turned on Data Channel Offload for throughput and have been chasing intermittent reconnects, this is your patch.

6. GNOME 50.4 and 49.9 Patch GDM

Both trains shipped August 5 with security hardening for the display manager: path traversal, autologin bypass, and a denial-of-service flaw. GLib 2.88.3 separately addresses CVE-2026-15588, a D-Bus pre-authentication denial of service. GNOME 50.4 also adds HDR mastering display metadata in mutter.

Hot take: The GLib D-Bus fix matters well beyond the desktop. GLib is on plenty of headless boxes, and pre-authentication DoS is exactly the kind of bug that shows up in a container base image nobody thought to rebuild. Check your images, not just your laptops.

7. uutils Coreutils 0.10 Hits 93.5% GNU Compatibility

The Rust reimplementation of GNU coreutils now passes 645 of 690 GNU test cases, up from 90.58% in 0.9. The August 5 release adds mv --exchange for atomic path swapping, rm --one-file-system, an OpenSSL backend for checksums, TOCTOU race elimination, and symlink cycle protection.

Hot take: mv --exchange is the sleeper feature. Atomic path swapping is genuinely useful for blue-green deploys of static assets, and people have faked it with symlink dances for decades. Compatibility is climbing about three points per release, which puts full parity within realistic reach.

8. Kubernetes v1.37 Will Break Clusters That Skipped the Deprecation Notices

v1.37.0 is scheduled for August 26. Two changes belong on your calendar. The release requires containerd 2.0 or later. And nodes running cgroup v1 without an explicit failCgroupV1: false override in the kubelet config will refuse to start the kubelet at all.

Hot take: This is the deprecation cycle cashing its check. "Refuse to start the kubelet" isn't a warning in your logs, it's a node that doesn't come back. Audit your node images for containerd version and cgroup driver now, not on August 27.

What We're Watching Next Week

Gitea exploitation in the wild. CVE-2026-59774 has a public write-up, an obvious escalation path, and a large population of internet-facing instances. Scanning usually follows within days.

Whether other projects follow Rust. The policy text is reusable and the problem is universal. Watch the big Linux Foundation projects.

Proxmox Arm64 hardware reports. Feature parity on paper is one thing. The forum threads over the next two weeks will tell you which boards actually boot.

The Bottom Line

Three of this week's eight stories are patches you should apply today, one is a deadline three weeks out, and one is a genuine platform expansion. If you only do one thing: check your Gitea version. If you do two: audit your Kubernetes nodes for containerd 2.0 before the 26th.

The Arm story is the one that still matters in six months. A hypervisor with a real support lifecycle is the difference between Arm as a hobbyist curiosity and Arm as a budget line item. That line got crossed this week.

If you'd rather not be the person tracking CVE advisories and upgrade deadlines, Elestio runs managed deployments of Gitea and 400+ other open-source applications, with patching, SSL, and backups handled for you. VMs start at $16/month for the entry NETCUP config (2 vCPU, 4 GB RAM, 60 GB NVMe).

Thanks for reading ❤️ See you next Friday 👋