Self-Hosting Weekly — August 19, 2026: Patch week, kernel 7.2

This week is mostly about applying updates rather than chasing shiny new things: Gitea shipped a release with SECURITY-flagged fixes, rsync 3.5.0 arrived with a pile of security fixes of its own, and Nextcloud pushed coordinated maintenance builds across three branches. Underneath it all, the 7.2 kernel is out. And if you need motivation to actually do the patching, one homelabber published a postmortem of getting breached.

This Week's Highlights

A homelab breach, written up honestly. The most-discussed link of the week is a first-person postmortem titled "My Homelab Got Hacked", which surfaced on Lobsters and drew a substantial comment thread. Public breach writeups from individuals are rare — the incentive is to quietly rebuild and never speak of it again — which is exactly why this one is worth your time.

Why it matters: the stack described is the stack most readers of this newsletter run. If you have been putting off an audit of what is actually reachable from the internet, and what is sitting behind nothing but a password, this is the nudge. Read it, then go look at your own reverse proxy config.

Close-up of server racks in a data center highlighting modern technology infrastructure.
Close-up of server racks in a data center highlighting modern technology infrastructure.

Gitea v1.27.2 — patch this one. The v1.27.2 changelog opens with a SECURITY section, including a fix to collaborator access mode and httpsign. Self-hosted Gitea instances tend to be internet-facing by design — that is rather the point of hosting your own forge — and SSH commit signing is commonly enabled.

Access-mode bugs are the category you want to take seriously without waiting to fully understand them: they govern who can do what to which repository. If you run Gitea, this is a same-day upgrade rather than a next-maintenance-window one.

The 7.2 kernel has been released. LWN has the announcement, with Linus noting that the final week of the release was, once again, bigger than he would have wished for. Mainline releases rarely change anything for you the day they land — your NAS, hypervisor and container hosts are running whatever your distro ships — but this is the base layer everything else eventually inherits.

The practical read: nothing to do today, but the fixes and features in 7.2 are what filters down into distro kernels over the coming months. Worth skimming so you know what is coming to your storage and virtualization layers later this year.

New Releases & Updates

  • Nextcloud v34.0.3 — coordinated maintenance releases across three supported branches, with v33.0.8 and v32.0.14 landing alongside it; the usual sign that fixes worth taking have been backported. Release notes
  • rsync 3.5.0 — a feature release carrying, in the project's own words, a huge number of security fixes; rsync major versions are rare enough that reading the changelog before upgrading a backup pipeline is genuinely warranted. LWN summary
  • Home Assistant 2026.8.2 — second patch release of the 8.x line, tidying up integration bugs including Teslemetry converting streamed tyre pressure and isolation resistance to their declared units. Release notes
  • Traefik v3.7.11 — bug fixes including rejecting out-of-range status codes from backends when using FastProxy, with a v2.11.55 companion release keeping the legacy branch alive. Release notes
  • Portainer 2.39.6 LTS — an LTS branch update with known-issues notes covering Async Edge environments (an invalid update schedule date can appear when browsing a snapshot) and Podman support; read them before you upgrade. Release notes
  • n8n 2.36.0 — the one substantive release in a week of a dozen patch tags, with bug fixes including aligning ai-builder HITL approval resume schemas with the confirm envelope. Release notes

Silhouette of a navigator using binoculars on a cargo ship's bridge, surrounded by navigation equipment.
Silhouette of a navigator using binoculars on a cargo ship's bridge, surrounded by navigation equipment.

Community Spotlight

Tailscale published a debugging writeup on how they tracked down a 16-year-old SQLite bug — a WAL reset issue that manifested as database corruption. The reason this belongs in a self-hosting newsletter rather than a database one: SQLite is the default storage backend for an enormous slice of self-hosted applications, quietly sitting under your *arr stack, your bookmark manager, your monitoring tool. The failure conditions described are ones a homelab can actually hit, not lab-only exotica. It is also just a very good example of the genre — a long chase through layers of a stack to a root cause that had been sitting there since before most of these apps existed.

  • beszel — lightweight server monitoring with Docker stats built in, a low-overhead alternative to standing up a full Prometheus and Grafana stack (Lobsters discussion).
  • TIL docker restart doesn't re-read your .env — an r/selfhosted thread on a footgun that catches people repeatedly: a restart reuses the environment the container was created with, so an edited .env only takes effect once the container is recreated.