Self-Hosted Weekly

A collection of 25 posts

Self-Hosted Weekly

Self-Hosted Weekly: Week 44, 2026. Brotli Hits KEV, HACS Absorbed, Forgejo Patches

A compression library you have never configured, patched in private eight months ago, is now on CISA's actively-exploited list and sitting inside half your stack. Elsewhere, the tools that move your code had a rough week, and Home Assistant is about to absorb the add-on store

Self-Hosted Weekly

Self-Hosted Weekly: Week 40, 2026. Gitea 28, Keycloak Agent Tokens, Weekly Ubuntu Kernels

Week 40: Gitea 28 routes Git traffic through an egress proxy, Keycloak 26.8 adds delegated tokens for AI agents, Ubuntu goes to weekly kernels.

Self-Hosted Weekly

Self-Hosted Weekly: Week 39, 2026. WordPress Exploited, Portainer CE Frozen, Ubuntu Escape

WordPress shipped two security releases in five days, and attackers were probing the second fix within hours. Ubuntu has a container escape with a public exploit and no kernel patch. Portainer confirmed that its free edition stops at 2.x. Here's what mattered this week. 1. WordPress patches

Self-Hosted Weekly

Self-Hosted Weekly: Week 38, 2026. Keycloak 6 CVEs, Nextcloud 35, Postgres 19 Slips

Your identity provider shipped six CVEs in one patch, your file server got a major version, and the database everyone expected in September became an October release. Two projects also changed what "open source" means for them, one by licence and one by walking away. Here's

Self-Hosted Weekly

Self-Hosted Weekly: Week 37, 2026. Jellyfin 12, Nitter Lives, SourceHut Bans AI

A media server dropped a version number it never needed, two forges drew opposite conclusions about AI, and a project with tens of thousands of stars quietly turned off the lights. Here's what actually mattered in self-hosted land. 1. Jellyfin 12.0 lands, and drops the pointless

Self-Hosted Weekly

Self-Hosted Weekly: Week 36, 2026. AWS Buys DuckLabs, CRA Deadline, K8s 1.37

Short week, dense news. An acquisition that says a lot about how open-source governance is being structured in 2026, a compliance deadline that lands in seven days, and Kubernetes quietly shipping the feature that makes small clusters cheaper to run. Here is what mattered. 1. AWS bought DuckLabs. DuckDB

Self-Hosted Weekly

Self-Hosted Weekly: Week 35, 2026. PostgreSQL CVEs, Mojo, Planka SSO

Some weeks the self-hosted world coasts. This was not one of them. The largest security patch PostgreSQL has ever shipped, a Kanban board that locked SSO behind a paywall overnight, and a compiler that went open source three weeks after a $3.9 billion acquisition. Here are the seven

Self-Hosted Weekly

Self-Hosted Weekly: Week 34, 2026. Linux 7.2, isolated-vm Escape, Go 1.27

Two sandbox escapes, a kernel release Linus almost didn't have time for, and a Go release that quietly swapped the engine under encoding/json while you weren't looking. If you run anything self-hosted, this week's list is less "interesting reading" and

Self-Hosted Weekly

Self-Hosted Weekly: Week 33, 2026. Jellyfin Exodus, rsync 33 CVEs, Podman 6.1

This was a rough week for the software most of us actually run. Jellyfin lost three of its most senior people in a matter of days. The rsync project shipped a release fixing 33 security issues at once, which is not a number you see on a 30-year-old

Self-Hosted Weekly

Self-Hosted Weekly: Week 32, 2026. Proxmox Arm64, Rust AI Policy, Gitea CVE

Week 32 delivered the thing the homelab crowd has wanted since the first Raspberry Pi cluster: real Arm virtualization, officially supported. It was also the week Rust told its contributors to stop letting language models write their patches, and the week a 9.8 in Gitea reminded everyone that self-

Self-Hosted Weekly

Self-Hosted Weekly: Week 31, 2026. n8n AI Builder, Immich 3, Paperless-ngx 3.0.4

This was a patch-and-polish week across the self-hosted catalog. No dramatic launches, but two projects we care about shipped real upgrades, and a whole stack of tools you probably run pushed point releases worth taking. Here are the eight updates from the Elestio catalog that mattered this

Self-Hosted Weekly

Self-Hosted Weekly: Week 30, 2026. ServiceNow RCE, GitHub's $100M, Logseq 2.0

Another week, another reminder that self-hosting is equal parts freedom and responsibility. This week brought a nasty pre-auth exploit making the rounds, a community funding milestone with an asterisk, and a beloved note-taking app deciding to split itself in two. Grab a coffee. Here are the eight

Self-Hosted Weekly

Self-Hosted Weekly: Week 29, 2026. SharePoint Zero-Day, Nextcloud Migration, KVM Escape

Some weeks the theme picks itself. This week it was trust: who you hand your infrastructure to, and what happens when that trust turns out to be misplaced. Microsoft shipped a SharePoint zero-day that was already being exploited, a German state walked away from SharePoint entirely in the same

Self-Hosted Weekly

Self-Hosted Weekly: Week 27, 2026. TrueNAS 26, Grafana RCE, Gemma 4

Another week, another reminder that "self-hosted" and "AI agents" are quietly becoming the same conversation. This week gave us a homelab NAS that keeps eating Proxmox's lunch, two security patches you should apply before the weekend, a fresh batch of open models you

Self-Hosted Weekly

Self-Hosted Weekly: Week 26, 2026. n8n RCE, Ingress-Nginx Retired, KubeCon Goes Agent

Two remote-code-execution holes in tools you probably run, a Kubernetes mainstay officially put in the ground, and the whole industry deciding that agents need their own infrastructure. This was not a quiet week. If you only do one thing after reading this, patch n8n and Open WebUI. Then

Self-Hosted Weekly

Self-Hosted Weekly: Week 25, 2026. Mastra npm Attack, Euro-Office Ships, Pangolin 1.19

Another week, another reminder that self-hosting is half about the software you run and half about the supply chain it rides in on. This week handed us a nasty npm compromise, a genuine European answer to Microsoft Office, a Pangolin release that quietly turns your browser into a remote

Self-Hosted Weekly

Self-Hosted Weekly: Week 21, 2026. Bambu Sues OrcaSlicer Dev, MkDocs Forks, Open Source Endowment Launches

Quiet week? Not quite. A 3D printer manufacturer is suing the developer who restored cloud printing in a fork, MkDocs just lost its last serious maintainer and three forks are now competing for its corpse, and a 501(c)(3) finally got stood up to pay open source maintainers a

Self-Hosted Weekly

Self-Hosted Weekly: Week 18, 2026. Mistral 3.5 Lands, Hashimoto Quits GitHub, cPanel CVSS 10

If you ran a self-hosted stack this week, you probably felt the ground move. Mistral dropped a 128B model that fits on four GPUs, Mitchell Hashimoto walked Ghostty off GitHub, and a cPanel zero-day got everyone scrambling before the weekend. Plus a new self-hosting box, a Home

Self-Hosted Weekly

Self-Hosted Weekly: Week 17, 2026. K8s Scale-to-Zero Lands, Cal.com Goes Closed, and a CVSS 10 Hits AVideo

Another loaded week in the self-hosted world. Kubernetes finally turned on the feature people have been asking about for seven years, Cal.com made a decision that lit up every tech forum, and a CVSS 10.0 dropped on a video platform you might actually be running. Let'

Self-Hosted Weekly

Self-Hosted Weekly: Week 16, 2026. Mozilla Drops an AI Client, K8s 1.36 Preview, and Valkey Takes Over

You know that feeling when every tab in your browser has breaking news? That was this week for the self-hosted world. Mozilla dropped an AI client nobody saw coming, Kubernetes 1.36 is about to land with some genuinely useful changes, and the Valkey takeover is now officially complete

Self-Hosted Weekly

Self-Hosted Weekly: Week 15, 2026. Trivy Breach Hits the EU, Linux 7.0 Incoming, and Nix Gets a CVSS 9

This was the week the open-source supply chain broke in the most spectacular way possible. A poisoned version of Trivy — the vulnerability scanner half the industry trusts to keep them safe — gave attackers the keys to the European Commission's cloud. Meanwhile, Linux 7.0 is days away,

Self-Hosted Weekly

Self-Hosted Weekly: Week 14, 2026. Gemma 4 Goes Apache 2.0, Ingress NGINX Is Dead, and Docker Gets Patched

Welcome back to Self-Hosted Weekly, your Friday roundup of everything that matters in open-source and self-hosting. This was a big one — Google dropped its most capable open models ever, Kubernetes lost its most popular ingress controller, and Docker shipped a critical security patch. Let's get

Self-Hosted Weekly

Self-Hosted Weekly: Week 12, 2026. GTC Goes Open Source, $12.5M for FOSS Security, and Docker v29 Breaks Everything

Welcome back to the Self-Hosted Weekly. This week: NVIDIA went all-in on open-source AI at GTC, the Linux Foundation secured $12.5 million for FOSS security, a new secrets scanner was born, and Docker v29 is quietly breaking things. Let's get into it. 1. NVIDIA

Self-Hosted Weekly

Self-Hosted Weekly: Week 10, 2026. NGINX Ingress Is Gone, the Pentagon Goes Open Source, and AI Code Gets Banned Again

Welcome back to Self-Hosted Weekly, your Friday roundup of everything that matters in the open-source and self-hosting world. This week: a major Kubernetes retirement finally hits, the Pentagon goes open source, and the AI-generated code debate escalates again. 1. NGINX Ingress Is Officially Dead The March

Self-Hosted Weekly

Self-Hosted Weekly: Week 9, 2026. MinIO Is Dead, the Open Source Endowment Launches, and AI Slop Hits Maintainers

It's been a big week in the self-hosted world. MinIO, one of the most relied-upon S3-compatible storage solutions, got officially archived. A new nonprofit wants to throw $100M at open source funding. And AI-generated contributions are pushing maintainers to the breaking point. Here are