Self-Hosted Weekly: Week 39, 2026. WordPress Exploited, Portainer CE Frozen, Ubuntu Escape
WordPress shipped two security releases in five days, and attackers were probing the second fix within hours. Ubuntu has a container escape with a public exploit and no kernel patch. Portainer confirmed that its free edition stops at 2.x. Here's what mattered this week.
1. WordPress patches twice, and the second bug is already being exploited
WordPress 7.1.1 landed on September 17 with 11 security fixes, including Click2Shell: a crafted link that, opened by a logged-in admin, makes WordPress install and preview a theme from WordPress.org. On its own that scores CVSS 7.1. Chained with a flaw in the installed theme, it reaches code execution. Five days later, WordPress 7.1.2 fixed CVE-2026-87902 (CVSS 9.2), a path traversal in page template resolution that lets an unauthenticated attacker include a local PHP file outside the theme directories. Exploitation attempts started the same day, aimed at pearcmd.php. The fix is backported to every branch from 4.7 onward.
Our take: The conditions for CVE-2026-87902 are narrow: an active theme whose folder name starts with "page-" and a readable PHP file such as pearcmd.php on the server. Update, then check whether your PHP image ships PEAR at all. If you run WordPress and auto-updates are off, this is the week to turn them on.
2. Ubuntu has a public container escape and no patch yet
CVE-2026-80521 is a use-after-free in the kernel's garbage collector for AF_UNIX sockets. An unprivileged process inside a container can race it and end up root on the host. Upstream fixed it on August 6 in Linux 7.2 and 7.1.10. As of today, Ubuntu's tracker still lists 26.04, 24.04 LTS and 22.04 LTS as vulnerable, and a working exploit was published this week.
Our take: A container is not a security boundary against the kernel it shares, and this is the reminder. If you run untrusted or multi-tenant workloads on Ubuntu hosts, give them a dedicated VM or a microVM runtime until the kernel update lands. If every container on the box is yours, patch when Canonical ships and don't panic.
3. Portainer's free edition stops at 2.x
Portainer announced on September 11 that 3.0 is a Kubernetes-first rewrite and that Community Edition stays on the 2.x codebase. The reaction built all week, with coverage on September 21 spelling out the split: 2.45 CE keeps getting security fixes and bug fixes, plus backports of 3.x features where a Docker API equivalent exists. The new features themselves live in Business Edition, which is proprietary. The free route to 3.x is the "3 Nodes Free" program, which already covers more than 110,000 licenses.
Our take: Nothing breaks this year. The zlib-licensed CE you run today keeps working and keeps getting patched. What changed is the direction: new work goes into a closed product, and CE gets what fits through the Docker API. If you use Portainer for Docker hosts, stay on 2.45 and revisit the choice only if a 3.x feature you need never reaches CE.
4. Open WebUI 0.11.4 fixes access control and shrinks its images
Open WebUI v0.11.4 shipped September 21 with a list of security and access-control fixes, among them credentials no longer logged during identity provider sign-in, role mapping enforced for federated login, and knowledge file access tied to actual attachments. The new slim image is about 175 MB, 89% smaller, and the standard build lost roughly 170 MB.
Our take: The upstream notes ask production deployments to update soon. Several of these fixes only matter once you have more than one user or an SSO provider, which describes most team installs of Open WebUI.
5. PostgreSQL 19 Beta 4 is out, with a thinner feature list
Beta 4 arrived September 24. Most of the release is fixes to the new REPACK and WAIT FOR commands, logical replication, and the autovacuum scoring system. The confirmed revert list is longer than the one we reported last week: SQL/PGQ property graphs, online checksum toggling, temporal FOR PORTION OF updates, MERGE and SPLIT PARTITIONS, and the pg_get_*_ddl() functions. The release candidate is expected in early October, with GA in October if testing goes well.
Our take: REPACK CONCURRENTLY is still in, and that alone justifies the upgrade for anyone who has scheduled a pg_repack window at 2 a.m. If you run PostgreSQL, Beta 4 is close enough to final to test your extensions and migrations against it now.
6. Appwrite 2.3 removes dev keys entirely
Appwrite 2.3.0 landed September 23 with two breaking changes. Dev keys are gone: endpoints, headers, scopes, and the collection that stored them. And the console URL is now one variable, _APP_CONSOLE_URL, replacing the old scheme setting.
Our take: Read the migration before you pull the image. If a CI job or local script still sends a dev key header, it fails after this upgrade. We covered the bigger jump in upgrading to Appwrite 2.0; 2.3 is smaller, but Appwrite users should grep their repos first.
7. PhotoPrism gets new face models, but you have to opt in
PhotoPrism's September 24 release ships new face detection and embedding models that find more faces, including small ones in group shots. Existing libraries stay on the old model until you run photoprism faces migrate, which keeps your name assignments. Also new: people can be marked Private or Hidden, Insta360 360-degree media is supported, the indexed file size limit rises to 5 GB, and libheif is updated to close eight CVEs.
Our take: Compare this with Immich 3.2 last week, where cluster groups meant resetting face recognition and losing assigned names. PhotoPrism kept the names and made the switch explicit. Take a backup, then run the migration on your PhotoPrism library.
8. RustFS reaches 1.0
We missed this one last week. RustFS 1.0.0 went GA on September 16 under Apache 2.0: an S3-compatible object store with erasure coding, tiering, site replication, IAM with OIDC and KMS, server-side encryption, and S3 Tables with an Iceberg REST catalog. Several 1.0.1 previews have shipped since.
Our take: The announcement has no benchmarks and no upgrade notes, so test on a copy of real data before trusting it with backups. RustFS is now a serious option for self-hosted S3.
What we're watching next week
The Ubuntu kernel update for CVE-2026-80521. The fix has been upstream for seven weeks, and the exploit is now public.
PostgreSQL 19 RC1. Expected in early October. If nothing else is reverted, the Beta 4 feature list is what ships.
The Papermerge deadline. The 30-day maintainer search opened on September 5 runs out around October 5. Forks exist on GitHub; the question is whether any of them gets a team behind it.
The bottom line
The urgent story is WordPress: two security releases in a week, and attackers on the second one before most sites had updated. Patch, then turn on auto-updates for the core.
The structural story is Portainer, which kept its license and moved new development into a closed product, leaving the open one in maintenance. That's harder to spot than a BSL switch, and over a few years the effect is similar. Look at where the commits go, not just at the LICENSE file.
Running any of this yourself? Elestio keeps 400+ open source services patched, backed up and monitored, so weeks like this one mean an upgrade notification instead of a weekend.
See you in the next one 👋