Most of this week's headline items are chores, not features. Gitea shipped its second security release in seven days, rsync 3.5.0 arrived with a pile of security fixes, and Nextcloud patched all three supported branches on the same day. Add a first-person homelab breach postmortem and an r/selfhosted thread about how rarely anyone actually tests a restore, and the theme writes itself: patch first, then prove you can rebuild.

This Week's Highlights

Gitea 1.27.2 is a security release — don't wait for your next image pull. The v1.27.2 release notes lead with a SECURITY section, including a fix to how collaborator access mode and HTTP signing are handled. That's the permission layer of your Git host, which makes it the sort of thing worth an out-of-band update rather than a monthly maintenance window.

What raises the urgency is the cadence: 1.27.2 follows 1.27.1 within the same week, meaning the project has now cut two security-fix releases back to back. If you're running Gitea behind a reverse proxy with any external exposure — or even just with multiple collaborators on private repos — pull the tag explicitly rather than relying on a :latest refresh that may not have propagated yet.

Self-hosted Git tends to sit in the "set it and forget it" tier of the stack, quietly holding infrastructure-as-code, secrets in .env examples, and deploy keys. It deserves the same patch discipline you'd give an internet-facing app.

Blue plastic wires with white tips connected to server and provide access to information
Blue plastic wires with white tips connected to server and provide access to information

A homelab breach postmortem worth your time. "My Homelab Got Hacked - A Postmortem" surfaced on Lobsters this week, and it's the rare security writeup aimed squarely at people running the same stack as our readers rather than at enterprise SOC teams. It's a first-person account of a compromise and what the author learned from it.

Generic hardening checklists age badly and blur together. Postmortems don't: they show which specific assumption failed, in what order things unravelled, and what the author would do differently. That's the kind of detail you can map onto your own compose files this weekend. The Lobsters discussion is worth reading alongside it for the usual round of "here's how I'd have caught that."

Jellyfin 12.0 RC5 is out. The team announced the fifth release candidate for the long-running 12.0 cycle, explicitly labelled a preview release intended for people who want to test 12.0 before the final public release.

Emphasis on test. RC5 is the point in a release cycle where it's genuinely useful to spin up a second instance against a copy of your library and find out what breaks — plugin compatibility, transcoding config, client behaviour — while the project can still act on the report. It is not the point to upgrade the instance your household actually watches TV on.

New Releases & Updates

  • rsync 3.5.0 — Released with what LWN describes as a huge number of security fixes; a minor-version bump after a long gap, so check the NEWS file against your existing cron jobs before assuming behaviour is unchanged. LWN coverage / release notes
  • Nextcloud 33.0.8 — Maintenance releases landed simultaneously across all three supported branches (32.0.14, 33.0.8, 34.0.3), a coordinated patch day affecting essentially every self-hosted instance. Release
  • Portainer 2.39.6 LTS — Point release for the LTS line, shipping with documented known issues around invalid update-schedule dates on Async Edge environments and gaps in Podman support. Read those before upgrading. Release notes
  • Home Assistant 2026.8.1 — The first patch release of the 2026.8 cycle, which is the usual signal that cautious users can move off last month's build. Release
  • Docker VMM public beta — A rewritten VM backend for Docker Desktop on Mac and Windows, pitched at performance, stability, and governance; relevant if you build compose stacks locally before shipping them to a Linux box. Docker blog
Detailed image of illuminated server racks showcasing modern technology infrastructure.
Detailed image of illuminated server racks showcasing modern technology infrastructure.

Community Spotlight

The thread of the week is "How often do you test a full restore of your self-hosted services?" on r/selfhosted, and its framing is the whole point: backups are easy to automate, but a successful backup job does not prove a service can be rebuilt. Configuration, database versions, secrets, and external volumes can each independently sink a restore while your backup dashboard stays reassuringly green. The comments are full of people describing what they actually do — restore drills, scratch VMs, documented rebuild runbooks — rather than what they know they should do. It pairs uncomfortably well with this week's breach postmortem: the moment you most need a restore is the moment you least want to discover your Postgres dump was taken with the wrong client version.

  • How we tracked down a 16-year-old SQLite bug — Tailscale on a long-latent WAL-reset corruption bug. SQLite backs a huge share of self-hosted apps, so this is both a good debugging story and practically relevant.
  • beszel — Lightweight server and container monitoring built around a single binary plus agent, for anyone who finds a full Prometheus/Grafana stack excessive for three machines. (Lobsters discussion)
  • Is Guacamole not popular anymore? — A solid survey thread on browser-based VNC/RDP/SSH access in 2026, prompted by one user whose Pi 5 setup works fine but who notices nobody talks about it anymore.

Wrapping Up

Patch Gitea and rsync this weekend, then pick one service and try rebuilding it from your backups — you'll learn more in an hour than from any hardening checklist. Subscribe to get next week's digest straight to your inbox.