Security

A collection of 29 posts

Security

Critical PHP RCE (CVE-2026-109618): Updating on Elestio

Last updated: 23 October 2026. All Elestio-built PHP images, including WordPress, Nextcloud, Moodle and GLPI, have been rebuilt on patched PHP and are available as updates in your dashboard. Services that run on the vendor's official image, such as Drupal, Matomo and Mautic, pick up the vendor&

Self-Hosted Weekly

Self-Hosted Weekly: Week 40, 2026. Gitea 28, Keycloak Agent Tokens, Weekly Ubuntu Kernels

Week 40: Gitea 28 routes Git traffic through an egress proxy, Keycloak 26.8 adds delegated tokens for AI agents, Ubuntu goes to weekly kernels.

Self-Hosted Weekly

Self-Hosted Weekly: Week 39, 2026. WordPress Exploited, Portainer CE Frozen, Ubuntu Escape

WordPress shipped two security releases in five days, and attackers were probing the second fix within hours. Ubuntu has a container escape with a public exploit and no kernel patch. Portainer confirmed that its free edition stops at 2.x. Here's what mattered this week. 1. WordPress patches

AI

immudb + AI Agents: Build a Tamper-Proof Audit Log

Your agent has a database connection with write access. It also has an audit table, sitting in that same database, that records what it did. If the agent goes off the rails at 3am and you spend the next morning reading that table to work out what happened, you are

Self-Hosted Weekly

Self-Hosted Weekly: Week 34, 2026. Linux 7.2, isolated-vm Escape, Go 1.27

Two sandbox escapes, a kernel release Linus almost didn't have time for, and a Go release that quietly swapped the engine under encoding/json while you weren't looking. If you run anything self-hosted, this week's list is less "interesting reading" and

Self-Hosted Weekly

Self-Hosted Weekly: Week 33, 2026. Jellyfin Exodus, rsync 33 CVEs, Podman 6.1

This was a rough week for the software most of us actually run. Jellyfin lost three of its most senior people in a matter of days. The rsync project shipped a release fixing 33 security issues at once, which is not a number you see on a 30-year-old

Self-Hosted Weekly

Self-Hosted Weekly: Week 31, 2026. n8n AI Builder, Immich 3, Paperless-ngx 3.0.4

This was a patch-and-polish week across the self-hosted catalog. No dramatic launches, but two projects we care about shipped real upgrades, and a whole stack of tools you probably run pushed point releases worth taking. Here are the eight updates from the Elestio catalog that mattered this

AI

Self-Host Presidio: Redact PII Before It Ever Reaches Your LLM

I did the thing you're not supposed to do. A customer emailed us a support transcript, I wanted a quick summary, so I pasted the whole thing into a hosted LLM. Halfway through typing the prompt I noticed it: full name, email, a phone number, and the last

Self-Hosted Weekly

Self-Hosted Weekly: Week 29, 2026. SharePoint Zero-Day, Nextcloud Migration, KVM Escape

Some weeks the theme picks itself. This week it was trust: who you hand your infrastructure to, and what happens when that trust turns out to be misplaced. Microsoft shipped a SharePoint zero-day that was already being exploited, a German state walked away from SharePoint entirely in the same

DevOps

Self-Host Infisical: A Secrets Manager for Your Apps and Agents

Here's a confession: for years my idea of "secrets management" was a .env file that lived in three places, drifted out of sync in all of them, and occasionally got pasted into a Slack thread so a teammate could unblock themselves. Then someone rotates a database

Self-Hosted Weekly

Self-Hosted Weekly: Week 26, 2026. n8n RCE, Ingress-Nginx Retired, KubeCon Goes Agent

Two remote-code-execution holes in tools you probably run, a Kubernetes mainstay officially put in the ground, and the whole industry deciding that agents need their own infrastructure. This was not a quiet week. If you only do one thing after reading this, patch n8n and Open WebUI. Then

Self-Hosting

Self-Hosted Weekly: Week 24, 2026. Jira's Self-Hosted Exit, Postgres 19 Beta, Home Assistant 2026.6

Some weeks the self-hosted world coasts. This was not one of them. The project behind your next Jira replacement shipped a migration tool, Postgres dropped its first 19 beta, and Home Assistant gave its dashboards a long-overdue rethink. Here are the eight stories worth your time this week,

Authentik

Authentik + Grafana: Add Single Sign-On to Your Dashboards

The first time someone leaves your team, you remember every place they had a login. Grafana is always one of them, and it's always the one nobody disabled. Local Grafana accounts are fine for a homelab of one, but the moment two or more people share dashboards, you

Self-Hosting

Self-Hosted Weekly: Week 23, 2026. Supabase Hits $10.5B, Euro-Office Ships, ChromaDB CVSS 10

Welcome back to Self-Hosted Weekly. This week had a bit of everything: a database company hitting a $10.5 billion valuation, Europe shipping its sovereign office suite (with a licensing fight attached), and three CVEs that should jump to the top of your patch queue, including a perfect 10

Security

Vaultwarden vs Passbolt: Which Self-Hosted Password Manager for Your Team?

Somebody on your team just pasted the production database password into Slack again. You knew it was time for a proper password manager months ago, you just didn't want to pay per-seat pricing for the privilege of storing your own secrets. Good news: two solid open-source

Self-Hosted Weekly

Self-Hosted Weekly: Week 21, 2026. Bambu Sues OrcaSlicer Dev, MkDocs Forks, Open Source Endowment Launches

Quiet week? Not quite. A 3D printer manufacturer is suing the developer who restored cloud printing in a fork, MkDocs just lost its last serious maintainer and three forks are now competing for its corpse, and a 501(c)(3) finally got stood up to pay open source maintainers a

Security

How to Set Up Wazuh for Self-Hosted SIEM and Threat Detection

Splunk Enterprise starts at around $2,000 per GB ingested per year. For an SMB pushing 50 GB of logs a day, that math gets ugly fast. So when somebody asks me what to deploy when they need a real SIEM but don't have a Fortune 500 budget,

Docker

5 Docker Compose Mistakes That Will Bite You in Production

You've got your docker-compose.yml working on your laptop. Containers come up, the app responds, everything looks fine. But "works on my machine" and "survives in production" are two very different things. Here are five Docker Compose mistakes that quietly set you up

Self-Hosted Weekly

Self-Hosted Weekly: Week 15, 2026. Trivy Breach Hits the EU, Linux 7.0 Incoming, and Nix Gets a CVSS 9

This was the week the open-source supply chain broke in the most spectacular way possible. A poisoned version of Trivy — the vulnerability scanner half the industry trusts to keep them safe — gave attackers the keys to the European Commission's cloud. Meanwhile, Linux 7.0 is days away,

Self-Hosted Weekly

Self-Hosted Weekly: Week 14, 2026. Gemma 4 Goes Apache 2.0, Ingress NGINX Is Dead, and Docker Gets Patched

Welcome back to Self-Hosted Weekly, your Friday roundup of everything that matters in open-source and self-hosting. This was a big one — Google dropped its most capable open models ever, Kubernetes lost its most popular ingress controller, and Docker shipped a critical security patch. Let's get

Security

How to Replace LastPass with Vaultwarden

In December 2022, LastPass disclosed that attackers had stolen encrypted vault backups for roughly 30 million users. That was bad. What's worse — three years later, those stolen vaults are still being cracked. Over $438 million in cryptocurrency has been traced back to that single breach, with thefts still

ollama

175,000 Ollama Servers Are Wide Open Right Now (Is Yours One of Them?)

Researchers from SentinelOne and Censys just dropped a report that should make every self-hosted AI enthusiast nervous: 175,108 Ollama instances across 130 countries are sitting on the public internet with zero authentication. No password, no API key, no nothing. Nearly half of them have tool-calling capabilities enabled.

Security

Open-Source Cybersecurity Tools Every Self-Hoster Should Know in 2026

Running self-hosted services is one of the smartest moves a business or homelab enthusiast can make. But here's the uncomfortable truth most self-hosting guides skip over: every service you spin up is another attack surface. And if you're not actively protecting your infrastructure, you&

Authentik

Authentik vs Authelia vs Keycloak: Choosing the Right Self-Hosted Identity Provider in 2026

If you're self-hosting applications in 2026, you've probably hit the authentication wall. Every app wants its own login. Your users are drowning in passwords. And you're one data breach away from a very bad week. The solution is an identity provider: a central

Guacamole

Guacamole + LDAP: Set Up Secure Remote Access for Your Entire Team

Remote access is one of those problems that sounds simple until you're managing 50 employees who all need to connect to different machines. TeamViewer wants $50/user/month. AnyDesk's pricing is a mystery. And your security team keeps asking about audit logs. Apache Guacamole solves this