Well... OK then.

24.04 -> 26.04 not super successful.

Proxmox Backup Manager Restore.... Very Successful.

Little slow with 1Gb... then again someone should just have a tiny OS drive and not... well... what this is.

Motivation to rethink my storage and partitions a bit.

Real lesson:
When the help on the console suggests that maybe... just maybe a few packages should have different sources maybe they should.

I might just do that and know for sure... later.

#selfhosting #proxmox

Hmm. For some reason, one of my #hawser agents stopped connecting to #dockhand. I've tried reinstalling it multiple times. I've confirmed the settings and the token. Still no luck. No idea what I'm doing wrong. The other agents work fine.

#selfhosting #sysadmin #docker

Півчетвертої ночі закінчили термінові правки на нашому сервері. Причина в тому, що в світі знайшли дві критичні вразливості в самій мові PHP. Їх назвали PHP2Shell, це CVE-2026-109618 і CVE-2026-109619. Оцінка 9.2 з 10, а для експлуатації не потрібна авторизація.

Основна наша система написана іншою мовою, але кілька окремих сервісів працювали на PHP. Ми несемо відповідальність за все, що крутиться на нашому сервері, тому закрили всі.

Що відомо станом на зараз.

Виправлення вийшли 21 жовтня у версіях 8.5.12, 8.4.27, 8.3.36 та 8.2.35. Старші гілки офіційних патчів не отримали.

Знайшли діри дослідники з допомогою моделей ШІ: першу версію компанія Calif ще в серпні, а Wiz незалежно виявила обидві. Дослідники кажуть, що вада існувала роками, але ШІ зробив її експлуатацію практичною.

Інформація витекла за день до виходу патчу. Спроби атак фіксували ще 17 жовтня, за кілька днів до публічного розкриття. Деякі уряди, за повідомленнями, на час відключили свої сайти.

Масштаб. PHP стоїть на близько 70% сайтів, де відома серверна мова. Це не означає, що стільки зламано: надійних цифр підтверджених зломів поки немає, і дослідники пишуть, що експлуатація складніша, ніж здавалось у перший день. Але ризик реальний, а старих версій без підтримки в мережі дуже багато.

Що зробити вам.

Перевірте, чи є PHP на сервері та в контейнерах: php -v, docker images.
Оновіть PHP і перезапустіть php-fpm або веб-сервер.
Якщо оновитись не можете одразу, вимкніть session.upload_progress.enabled.
Подивіться на дивні дочірні процеси від користувача веб-сервера і нові php файли.
Якщо сервіси були відкриті в мережі з 17 жовтня, змініть ключі та токени.

Бережіть себе і свої сервери 🙏

#PHP #PHP2Shell #Security #InfoSec #CVE #Fediverse #Linux #DevOps #SelfHosting

Automated watch of vulnerabilities affecting my infrastructure

In this blog post, I share how I get notifications, tickets and fix pull requests for newly published vulnerabilities affecting my infrastructure

https://dataswamp.org/~solene/2026-10-23-automated-vulnerability-watch.html

gemini://perso.pw/blog/articles/automated-vulnerability-watch.gmi

#security #selfhosting #automation #ci #ai #devops

@solene

🔐 CryptPad passe en 2026.10.0 sur mon instance : nouveau serveur, et Euro Office 9.3 remplace OnlyOffice 🇪🇺

Tuto pas à pas pour migrer une instance Docker Compose 👇
https://joplin.blablalinux.be/shares/zvEEX2jXOGz5E1lElSYiXW

Mon instance sur la liste officielle : https://cryptpad.org/instances/

#CryptPad #LogicielLibre #SelfHosting

Meine Nextcloud ist nach den PHP-Lücken immer noch offline, ich habs einfach noch nicht geschafft, die Patches einzuspielen.

Ich hinterfrage aktuell auch ein bisschen, ob ich eigentlich weiter Webservices offen im Internet betreiben will. Oder ob ich nicht z.B. die Nextcloud auf eine managed-Version umziehen will, wo Updates usw. beim Hoster liegen🤔

#selfhosting #php #php2shell #Nextcloud

@rede
Que tal mandar um alô pro ExercitoDoLula com um: #QueroPlanoDigital nos primeiros 10min da Live de 24h?
Bora puxar essa onda 🌊 ?

Aposto que boa parte do #Fediverso vai estar ligada nas redes das BigTex nessa hora.

#Jabber #OMEMO #Conversations #XMPPChat #FederatedMessaging #MensageriaFederada #Signal #SignalApp #SignalProtocol #PrivateMessaging #MensagensPrivadas #Criptografia #E2EE #SimpleX #SimpleXChat #SimpleXNetwork #NoUserIDs #PrivacyFirst #Privacidade #Matrix #MatrixProtocol #Element #ElementX #MatrixChat #DecentralizedChat #ChatFederado #Jitsi #JitsiMeet #OpenSourceVideo #VideoConferencia #ReunioesLivres #SelfHosted #Nextcloud #NextCloudHub #SelfHosting #AutoHospedagem #CloudSoberana #OpenSourceCloud #NextcloudFiles #Riseup #RiseupNet #RiseupVPN #ActivistTech #TechActivism #TecnologiaAtivista #DigitalAutonomy #AutonomiaDigital #Proton #ProtonMail #ProtonVPN #ProtonDrive #ProtonPass #PrivacyByDesign #PrivacidadeDigital #EncryptedEmail #FreeSoftware #SoftwareLivre #Privacy #Privacidade #DigitalRights #DireitosDigitais #SelfHosted #AutoHospedado #Decentralization #Descentralização #Fediverse #Fediverso #DataSovereignty #SoberaniaDigital #E2EE #NoTracking #SemRastreamento #SurveillanceCapitalism #CapitalismoDeVigilância

After all that fuzz yesterday regarding #php2shell i think it is time for me to reconsider which internet facing services i really need. Not limited to that one using PHP but in general. Just minimizing the attack surface.
#selfhosting #php

Portainer Cuts the Cord Between Its Free and Paid Editions https://itsfoss.com/news/portainer-community-edition-freeze/

The free CE build is frozen on 2.x, while all new development goes into a Kubernetes-first, closed-source implementation.

#selfhosting

#Webuzo, Softaculous's hosting control panel for providers, resellers & site owners like CPANEL, has released an emergency release to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. #PHP #PHP2shell #Selfhosting

Alt...

Update Webuzo Current Version: 4.8.4 Latest Version: 4.8.5 Hi, The Webuzo Team has released Webuzo version 4.8.5, which includes EMPS security fix. [Security] Updated EMPS packages to address the security vulnerabilities CVE-2026-109618 and CVE-2026-109619. EMPS will be updated automatically. Launched in Release Candidate : 22-10-2026 Launched in Stable : 22-10-2026 Please stay tuned for more updates. If you have any suggestions, please let us know by emailing us at sales@webuzo.com. Regards, The Webuzo Team

The day is done fixing at work, time to start fixing my own stuff. 🫠

#selfhosting #php

Hej wszystkim! Czas na ponowne #introduction.

Znowu mnie poniosło i przeniosłem się (a raczej wróciłem) ze swojej instancji #Akkoma na #GoToSocial. Tak, wiem - za dużo kombinuję i eksperymentuję... W zwiazku z tym aby tradycji stało się zadość wrzucam nieco odświeżone introduction.

Jeśli miałbym określić swoje priorytety w trzech słowach, to brzmiały by tak: niezależność, prywatność i bezpieczeństwo (kolejność nieprzypadkowa )

Hobbystycznie bawię się w #selfhosting, czyli staram się hostować samodzielnie co tylko mogę i na ile mi wystarcza na to czasu.

Jestem "adwokatem" #opensource  używam otwartych rozwiązań gdzie tylko mogę. Właściwie to na każdym urządzeniu, które posiadam w domu (szczegóły w profilu).

Poza tym lubię eksperymentować ze wszystkim, pod co mogę się podpiąć - nawet odkurzacze.

Moim największym wrogiem jest czas, a raczej jego deficyt, ale w miarę możliwości wracam zarówno na fedi jak i na swoje blogi.

W wolnych chwilach jak już uda mi się odkleić od ekranu, wciąga mnie dobra lektura. Poza tym lubię sporty zarówno zimowe jak i letnie, czyli góry i jeziora o każdej porze roku, odpowiednio z buta lub na desce, wpław lub na łyżwach.

moje blogi:

brtk.eu

wolnoscwkieszeni.pl

Wegen #PHP2shell habe ich unsere #Nextcloud Instanzen erstmal offline genommen. Betreibe das hier mit den AIO Images.
Wie handhabt ihr das?
#selfhosting #homelab #php

Ich bin nicht aus Prinzip von Windows weg. Mein Wohnzimmer hieß Windows 11, und der Vermieter stellte dauernd Möbel rein, die ich nicht bestellt hatte: Copilot, OneDrive, Widgets, Bloatware. Also Pop!_OS auf eine zweite Platte, Dual Boot als Sicherheitsleine. Nach ein paar Wochen frage ich mich ernsthaft, wie ich Windows jahrelang ausgehalten habe. Welche Distro habt ihr – und warum? #Linux #OpenSource #Fediverse #Selfhosting

**frantically F5ing on several Github issues at the same time**

Oh boy, I do hope Github does not go down before we can get all these docker images merged and published.

#PHP #selfhosting #docker

According to this...

for c in $(docker ps --format '{{.Names}}'); do docker exec "$c" sh -c 'ls /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 2>/dev/null | grep -q "^php"' 2>/dev/null && echo "$c"; done

Looks like #FreshRSS is the only public-facing thing I'm hosting with #PHP in it. (?)

Putting it to sleep and making it local-only until a patch drops.

#selfhosting

Expose only share links of a private service with caddy

In this blog post, you will learn how to use caddy to expose only the share links of a service reachable over a VPN, and reduce its attack surface

https://dataswamp.org/~solene/2026-10-21-caddy-forward-auth-public-share-links.html

gemini://perso.pw/blog/articles/caddy-forward-auth-public-share-links.gmi

#selfhosting #security #network

@solene

7 hosts first a workaround and then updates with fresh versions. everything is fine, until next time. 😀 #PHP #PHP2Shell

Well, that’s my job. But if you went into the #selfhosting trap, it's your job, unpaid and urgent because "h4x0r ante portas" 🤷🏻‍♂️ Oh Baby, you are so "independent"!

Bad thing about self hosting: patching services with security problems

Good thing: being able to just shut them until the mess is sorted

#PHP #CVE #sysadmin #selfhosting

Selfhosting Bubble what would you say: how crutical is phpocalypse really? Should we shut down everything fi we are not ready to patch at 14:00 UTC or is there more hype than danger?
#phpocalypse #php #selfhosting

🚨 A heads-up for anyone running #WordPress, #Moodle, #Nextcloud or other PHP-based services.

PHP has confirmed two critical vulnerabilities, both rated 9.2/10. Fixes are scheduled for today, 21 October, at 14:00 UTC.

Prepare to patch PHP, not just your applications. CERT-EU advises considering temporary isolation of public-facing services if prompt patching isn't possible.

It sounds pretty bad. Affected versions are not yet confirmed but I've heard 5.4+

https://www.php.net

#PHP #Security #SelfHosting

Time for a new #introduction

Been offline for some time now but getting tired of Instagram again so here we are.

- #union member and #activist from #germany ( #igmetall )
- #coding on #macbook #m1
- Google pixel 7 running graphene os
- lover of #foss / #opensource
- #selfhosting my own services
- #traveling europe in my #oldtimer caravan #vanlife

Wanting to post on #privacy, #coding, #selfhosting.
Lobbying for open software and real social networks with organisations, unions, councils etc.

Some politics may slip in here or there, wanted to do two different accounts but don't have the time to maintain one.

Happy to meet you all!

Thunderstorms are becoming more frequent where I live, and a UPS has gone from being merely recommended to absolutely essential for my home server.

I had a cheap one just to get by, but I bought a mid-range model that I can manage using NUT. This shouldn’t have taken me more than half an hour, but I ended up going to bed at 2 a.m. yesterday because I couldn’t figure out how to configure it to shut down after a few minutes of a power outage.

Anyway, I’ve learned a lot, and I still have a lot to learn in this field.

#selfhosting

Alt...

Log and info about my UPS connected by USB to my homeserver

@alejandrobdn The "after a few minutes on battery" part lives in upssched, not upsmon. Make upssched your NOTIFYCMD, add EXEC to NOTIFYFLAG ONBATT and ONLINE, and put CMDSCRIPT, PIPEFN and LOCKFN at the top of upssched.conf, then
AT ONBATT * START-TIMER onbatt 300
AT ONLINE * CANCEL-TIMER onbatt
The script runs upsmon -c fsd when it fires. Test it once in a planned window.

https://techfuelhq.com/homelab/ups-testing-reality/?utm_source=mastodon&utm_medium=social&utm_campaign=distribution-2026-10&utm_content=nut-shutdown-test
#selfhosting

Also thinking about what to do in the medium- to long term. Continue with Proxmox? Switch to a bare-metal OS install, since I was mostly using a single VM + Docker for everything anyway, and get a HomeAssistant Green for my HA to keep it on separate hardware from the home server? Get two or three cheaper individual machines, connect them into a k8s cluster, host applications on that? Everything has its advantages and drawbacks. #selfhosting

Also shows the risk of #selfhosting - all my services are gone for the moment. Good: I have backups of the proxmox VMs. Bad: The proxmox cluster doesn’t have a quorum anymore, so I can’t start them on the remaining machine 🙃. May have to drop an old Pi into the cluster to get back to quorum so I can do stuff again until I the machine gets repaired or replaced.

OVHcloud CLI releases backdoored on GitHub to steal developer secrets -

#OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware.

#OVH . #Selfhosting
https://www.bleepingcomputer.com/news/security/ovhcloud-cli-releases-backdoored-on-github-to-steal-developer-secrets/

#introduction

Hi , my name is Mark.

I'm a retired Englishman living in #France , married to @theMLW

I've been tinkering on the #fediverse since it started as #Laconica.

I run https://www.ttrss.info and https://indieweb-hosting.com

I've spent the last decade #cycling in a #velomobile but prefer #walking now.

Some of my current interests are -

#walking #hiking #selfhosting #proxmox #wordpress #tor #ttrss #electro #techno #railway #trainhopping #gaming #thelongdrive #snowrunner

Today's Monday show: why a president at 33 percent still gets to decide who plays Seymour in Grand Prairie. The long version a 9-minute read couldn't hold. 3PM EST

Our own server first — nobody owns this pipe but us:

https://live.thistleandmoss.org

What should I chew on?

#USPol #Midterms #Trans #QueerNews #Owncast #Fediverse #SelfHosting #IndieMedia #Politics #Trump

#DNS #AdBlocking adventures:
- #AdGuard kinda works, but is this the cause of my occassional DNS problems?
- #Technitium dotnet, not gonna get it to work on #OpenBSD, which still has a place in my network/services
- Blocky stinks of LLMs

I guess I'm gonna end up with #unbound and cronjobs updating blocklists.

#SysAdmin #SelfHosting #privacy #HomeLab

This is lovely.

Click on random stuff on the Bandcamp player, grab the URL of any label/artist that sounds good and then feed the batch to bcdl and it will grab anything that's free to grab. Insta music collection in your preferred format, unzipped and deposited where you wish.

Bandcamp always been a pain for me to navigate, this feels a much better way to explore and try new music.

https://github.com/daot/bcdl

#music #selfhosting #freemusic #musichoarder

Raspberry Pi 5 2GB is $77.50 as of Oct 2026. Specs, Pi-hole needs (512 MB RAM), Home Assistant and Nextcloud limits, and who should buy.

https://theunhacked.com/raspberry-pi-review-local-logic/

#privacy #DNS #selfhosting

How much of YOUR data is on a computer that you do not own?

Me: None of it.

Russians understand this, thanks to Ukraine (slava!). Do YOU?

#selfhosted #selfhosting #cloud #data #security #infosec #ai

Alt...

Never trust a computer that you don't own. The "cloud" is a network of computers you don't own. * Data in the cloud is being used to train Al * Hackers can get it * The corporation running it can wipe whatever they want * Fascists could easily ban any commercial server or service * Media just... disappears...like on YouTube or streaming services. So download everything. Buy hard drives and hoard as you go. Mirror that data once or twice. Store a copy powered off and unplugged. Burn the super important stuff to archival grade M- DISCs. Run AirSonic or something open source to permit remote access of your media.

Eine Auswertung von einer Woche Logfiles und ein Blick darauf, wohin das „neue“ Internet steuert.

Der Anlass

Inspiriert von einem Beitrag über das Thema KI-Crawler auf kaffeeringe.de wollte ich wissen wie auf meinen Domains die Lage ist. Ich betreibe auf einem YunoHost-Server bei IONOS mehrere Dienste: dieses Blog, Nextcloud, PeerTube, Funkwhale und ein paar kleinere Anwendungen. Das ist […]

Mein #PeerTube Server hat endlich ein Publikum! Leider sind es KI-Crawler. Die schauen alles, liken nichts und kommen morgen wieder. Ich glaube, ich habe meine treuesten Fans gefunden.

#fediverse #ki #selfhosting #foss #schicksalsjahreeineskaisers

Self-Host Weekly (16 October 2026)

#Bitwarden license changes, software updates and launches, a spotlight on #Homelable, and more in this week's #selfhosted recap!

https://selfh.st/weekly/2026-10-16/

#selfhost #selfhosting #opensource #foss #homelab #server #newsletter #privacy #fediverse #mastodon #smarthome #gitlab #forgejo #github #sonarr #jellyfin #sysadmin #devops #development #ai #vibecoding #google #apple