Self-Hosting Weekly — August 16, 2026: Security patches and release candidates

Two security-flagged Gitea patches landed in the same week, a homelabber published an unusually candid postmortem of getting breached, and Jellyfin's long-running 12.0 cycle reached its fifth release candidate. Add a security-heavy rsync bump and simultaneous Nextcloud maintenance releases across all three supported branches, and this is a good week to actually read your changelogs.

This Week's Highlights

Gitea v1.27.2 — patch this one now. Gitea shipped v1.27.2 on August 13, and the release notes lead with a SECURITY section: a fix to how collaborator access mode and httpsign are handled. This is the second security-flagged patch in the 1.27 line in a single week — 1.27.1 preceded it — which is worth noticing on its own.

Access-control bugs are the category that matters most for Gitea specifically, because it's one of the services homelabbers most often expose to the public internet rather than tucking behind a VPN. A collaborator permission that resolves more permissively than intended is not a theoretical problem when your repos are reachable from anywhere. If you run Gitea, this is the update to do before the weekend project, not after it.

From above contemporary server cable trays without wires located in modern data center
From above contemporary server cable trays without wires located in modern data center

"My Homelab Got Hacked" — a real attack chain, start to finish. Over on phunky.cafe, someone wrote up their own breach in detail — the rarest and most useful genre in this space. Most hardening advice is abstract: put things behind a reverse proxy, use strong auth, keep things patched. A first-person postmortem turns that into a specific sequence of decisions, one of which turned out to be wrong.

The Lobsters discussion is worth reading alongside it. If you've ever waved off a hardening step because "it's just my homelab," this is the piece to read this week.

Jellyfin Server 12.0 RC5. The Jellyfin team announced the fifth release candidate for 12.0 on August 11 — still explicitly a preview release, intended for people who want to test 12.0 ahead of the final public release.

Jellyfin 12.0 is the project's biggest release in years, and reaching RC5 is the signal that the cycle is stabilizing rather than still churning. The practical advice: if you have a media server you care about, now is the time to stand up a test instance and rehearse the migration, so that stable day is boring instead of exciting. Just don't point an RC at your only copy of the library.

New Releases & Updates

  • rsync 3.5.0 — Released with what the announcement calls a huge number of security fixes; since rsync underpins most homelab backup scripts, read the notes before your next cron run. LWN / changelog
  • Nextcloud v34.0.3 — Maintenance releases landed simultaneously across all three supported branches (v34.0.3, v33.0.8, v32.0.14), so the read is simply "upgrade whichever branch you're on." Release notes
  • Home Assistant 2026.8.2 — Bugfix release for the monthly cycle, including integration fixes such as Teslemetry converting streamed tyre-pressure and isolation-resistance values to their declared units. Release notes
  • Portainer 2.39.6 LTS — An LTS-line update to the default Docker management UI, with documented known issues around Async Edge update schedules and Podman support that admins should read before rolling out. Release notes
  • Docker VMM public beta — A complete overhaul of the VM layer behind Docker Desktop on Mac and Windows, now in public beta, pitched on performance, stability and governance. Docker blog

Close-up of tower servers in a data center with blue and red lighting.
Close-up of tower servers in a data center with blue and red lighting.

Community Spotlight

The perennial argument came back around this week: "Google will SPAM your self-hosted email just because" on r/selfhosted collects fresh data points from people running textbook-correct SPF, DKIM and DMARC and still landing in Gmail's spam folder. It's the deliverability wall that every self-hosted mail project eventually hits, and the thread is a decent anchor for the bigger question of whether self-hosting email in 2026 is a reasonable plan or a hobby you take on with eyes open. Worth reading before you commit your family's mail to a box in your closet.

  • beszel — Lightweight server monitoring with Docker stats built in; a credible answer if you want visibility without running a full Prometheus stack. (discussion)
  • QEMU 11.1 released — More than 3,200 commits from 285 authors; upstream work that eventually flows down into Proxmox and libvirt hosts.
  • Glance live-updating dashboard with custom widgets — Real custom-widget configs you can copy, not just another dashboard screenshot.

Wrapping Up

A patch-first week: Gitea and rsync are the two to act on, and Jellyfin 12.0 is the one to start rehearsing. Subscribe to get the digest in your inbox every Sunday.