Two things dominate this week: patching and backups. Gitea shipped its second security release in a single week, rsync landed a feature release stuffed with security fixes, and one homelabber published a first-person account of getting compromised — a rare and uncomfortable read. On the fun side, Jellyfin 12.0 reached RC5, which means the longest-running media server upgrade cycle in self-hosting is finally in sight.
This Week's Highlights
Jellyfin 12.0 RC5 is out — start testing your migration. The Jellyfin team announced the fifth release candidate of Server 12.0. The project is explicit that this is a preview release, intended for people who want to test 12.0 before the final public release — not something to drop onto the box your household watches TV on.
That caveat aside, RC5 is a signal worth acting on. The 12.0 cycle has been running long enough that many homelabbers have simply stopped tracking it, and a fifth RC suggests the remaining gap to GA is shrinking. If you run Jellyfin with a large library, custom plugins, or hardware transcoding, the cheapest time to discover a migration problem is now, on a throwaway container pointed at a copy of your database — not on release day when the family is waiting.
Practical approach: snapshot your config volume, spin up RC5 alongside your current install, and check the things that historically break across major versions — plugin compatibility, transcoding profiles, and client playback on whatever TV app you actually use.
Gitea 1.27.2 is a patch-now release. Gitea published v1.27.2 as a security release, with fixes including collaborator access mode handling and httpsign. That's the second security release in the 1.27 line in one week, after 1.27.1.
Access-mode bugs deserve attention because they sit exactly where self-hosted Git is most sensitive: who can read and write which repository. And unlike a media server, a Gitea instance is very often reachable from the internet — teams expose it so CI, remote clones, and collaborators can reach it. That combination (internet-exposed, holds all your source and often your deploy keys) makes this the single highest-priority upgrade on this week's list. Read the release notes, upgrade, and while you're in there, take thirty seconds to confirm your instance isn't accidentally allowing open registration.
“My Homelab Got Hacked” — a postmortem worth your evening. A first-person breach writeup, published on phunky.cafe and discussed on Lobsters, made the rounds this week. Postmortems like this are rare in the self-hosting world: most of us either never notice a compromise or never write it up.
The value here isn't a specific CVE — it's the shape of the story. Homelabs accumulate exposed services faster than they accumulate documentation, and the gap between “I opened a port to try something” and “I forgot that port exists” is where incidents live. Read it alongside this week's Gitea and rsync patches, then go audit your own reverse proxy: what's actually published, what's behind auth, and what's still running a version you last updated during a different job.
New Releases & Updates
- rsync 3.5.0 — a feature release carrying what LWN describes as a huge number of security fixes; essential reading for anyone whose 3-2-1 backup strategy is a shell script. LWN coverage / release notes
- Linux 7.2 — the new mainline kernel is out, with Linus noting the final week was once again bigger than he'd have liked; this becomes the baseline for host distros, container runtimes, and driver support. Announcement
- Nextcloud 34.0.3 — maintenance releases landed across every supported branch (32.0.14, 33.0.8, 34.0.3) alongside the first 35 betas, making this the standard upgrade checkpoint for self-hosted cloud users. Release
- Home Assistant 2026.8.2 — the second patch of the 8.x cycle, with integration fixes including Teslemetry streamed tyre pressure and isolation resistance now converted to their declared units. Release
- Portainer 2.39.6 LTS — an LTS patch for the most common Docker management UI; skim the documented known issues around Async Edge environments and Podman support before you upgrade. Release
Community Spotlight
The perennial pain of running your own mail server resurfaced in “So apparently Google will SPAM your self-hosted email just cuz” on r/selfhosted. It's the deliverability story everyone who has ever run their own MX server knows: your records are correct, your server is clean, and Gmail still files your mail under spam. The thread is worth reading less for the complaint than for the replies, which collect the usual real-world remedies — SPF, DKIM and DMARC hygiene, IP and domain reputation, warm-up patterns, and the uncomfortable question of whether to relay outbound through a third party. If self-hosted mail is on your someday list, the thread is a fair preview of the ongoing maintenance it actually asks for.
Worth Doing This Week
- Upgrade Gitea to 1.27.2 first — it's the most likely service on this list to be internet-exposed, and the fixes touch access control.
- Patch rsync to 3.5.0 anywhere it runs on a schedule against data you care about.
- Roll the Nextcloud, Home Assistant, and Portainer patches in your normal maintenance window.
- Test Jellyfin 12.0 RC5 in a throwaway container against a copy of your database — not on the box the household uses.
- Read the homelab postmortem, then audit what your reverse proxy actually publishes.
