Self-Hosted Weekly: Week 35, 2026. PostgreSQL CVEs, Mojo, Planka SSO

Some weeks the self-hosted world coasts. This was not one of them. The largest security patch PostgreSQL has ever shipped, a Kanban board that locked SSO behind a paywall overnight, and a compiler that went open source three weeks after a $3.9 billion acquisition. Here are the seven Week 35 stories that touch your stack.

1. PostgreSQL Ships 28 CVEs in One Release

August 13 brought PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24, and 19 Beta 3: twenty-eight security fixes plus over 110 bug fixes, the most CVEs ever closed at once. The worst is CVE-2026-6464 (CVSS 8.1), where a psql COPY FROM STDIN early failure causes remaining data lines to be processed as psql meta-commands. Also patched: an oidvector bug leaking server memory and a heap overflow in pg_trgm.

Hot take: Twenty-eight is not a sign PostgreSQL got worse. It means more people are looking, which is what you want from the database under everything you run. Patch it anyway. And if you are still on 14, it hits end of life this November with one patch left.

2. Planka Puts SSO Behind a Paywall, and Users Get Logged Out

Planka's v2.2.0 release moved OIDC and SSO from the Community edition into Planka Pro. The rough part was the upgrade path: users who had only ever authenticated through SSO were deactivated after updating, because they had no password to fall back on. Maintainers say SSO drove heavy support load and reads as an enterprise feature. Vikunja and Kaneo moved fast to market free SSO instead.

Hot take: The SSO tax keeps spreading because it works as a monetization lever. The lesson is that identity should be a layer you own, not a feature your Kanban board rents you. Put Keycloak or Authentik in front of your stack and this becomes an annoyance instead of an outage.

3. Mojo Goes Fully Open Source Under Apache 2.0

Modular opened the Mojo compiler and toolchain under Apache 2.0 with LLVM exceptions, a week after shipping Mojo 1.0. Everything needed to build the language from scratch is now in the main GitHub repo. Context matters: this landed roughly three weeks after Qualcomm acquired Modular for $3.9 billion. Modular is not accepting outside contributions to the compiler yet, and plans to by the end of 2026.

Hot take: Source-available and contribution-open are different things, and the gap between them is where most "we open sourced it" announcements live. Still, Apache 2.0 on a compiler a chip company just paid billions for is a good outcome. Watch whether the contribution door opens in December.

4. Docker Launches Kanvas to Turn Compose Files Into Manifests

Docker, working with Layer5, launched Kanvas, which parses a Docker Compose file and generates the corresponding orchestration resources: Deployments, Services, and configuration. It ships as a Docker Desktop extension through Docker Hub, putting it in direct competition with Helm and Kustomize.

Hot take: Converters like this have a long graveyard behind them, always for the same reason: the manifests are fine for a demo and wrong for production, because Compose has no vocabulary for resource limits, probes, PDBs, or affinity. Treat Kanvas output as a first draft, not a pipeline.

5. NVIDIA Ships SkillSpector, and the Numbers Are Ugly

NVIDIA released SkillSpector, an open source security scanner for AI agent skills, the executable plugin components used by Claude Code, Codex CLI, and Gemini CLI. Point it at a directory, a zip, a SKILL.md, or a Git URL and it returns findings, a risk score, and recommendations, using static analysis across 64 vulnerability patterns in 16 categories plus an optional LLM pass to cut false positives. The research behind it scanned 42,447 marketplace skills: 26.1% contained at least one vulnerability, 5.2% showed likely malicious intent.

Hot take: One in twenty agent skills on public marketplaces looks deliberately malicious, and every one runs with your agent's full permissions. If you are wiring agents into self-hosted infrastructure, this is npm circa 2018 all over again. Scan before you install.

6. Multikernel Linux Publishes Its First Public Kernel Tree

Multikernel Linux released v7.0-mk2, its first public kernel tree, built on Linux 7.0. It runs several independent kernels side by side on one machine, each with dedicated CPUs, memory, and PCI devices. One instance acts as host and partitions the hardware, and each kernel boots directly on the metal rather than inside a VM. Only x86_64 is supported so far.

Hot take: This sits in the gap between containers, which share a kernel, and VMs, which pay a virtualization tax. For anyone running one big box, kernel-level isolation without a hypervisor is appealing. It is also v7.0-mk2 on one architecture, so keep it off anything you care about.

7. NeoSearch Opens Its Source Under Apache 2.0

NeoSearch, a privacy-focused search engine built over two years and largely self-funded by creator Bart Jellema, published its full code on GitHub under Apache 2.0. It does not log IPs, set cookies, build profiles, or store search history. Its ranking scores how commercial or independent each result is, pushing affiliate listicles and SEO farms down while lifting independent sources.

Hot take: Search is the hardest thing on this list to self-host, because the moat is crawl infrastructure, not code. An alpha engine will not dent Google, but the stated next step of crawling forums, personal sites, and independent blogs is worth watching.

What We're Watching Next Week

• MsQuic CVE-2026-62815, a CVSS 9.8 unauthenticated RCE in Microsoft's open source QUIC implementation. It underpins HTTP/3 in more places than teams realize. Audit your dependency tree.
• LibreOffice 26.8, which brought a new Paragraph Composer in Writer and native OpenType variable font support. Worth a look if you run a self-hosted collaboration stack.
• Home Assistant 2026.9. The 2026.8 release landed this month with content-based smart search for Immich photos.
• Whether Planka reverses course. SSO paywall reversals happen when the backlash is loud enough.

The Bottom Line

The thread running through this week is that the things you depend on keep changing their terms, and the fix is the same: own the layer underneath.

If you would rather not babysit the patching, Elestio runs fully managed PostgreSQL from $11/month with automated backups, SSL, and monitoring across AWS, Azure, Hetzner, and DigitalOcean. Same for Keycloak, Authentik, and the rest of the 400+ open source services in the catalog. You keep the software and the control. We handle the 2 AM CVE.

See you next Friday for Week 36 👋

Thanks for reading ❤️