This week hands us a rare gift: someone running the same stack you do got popped, and wrote up exactly how. Pair that with a security-flagged Gitea release, a fresh mainline kernel, and an rsync major bump carrying a pile of security fixes, and you have a patching afternoon ahead of you. Grab coffee — most of this is short, and all of it is actionable.
This Week's Highlights
A homelab postmortem worth reading twice. The standout item this week is My Homelab Got Hacked - A Postmortem, a first-hand breach writeup from someone running the kind of self-hosted stack most of this newsletter's readers operate. Postmortems from big cloud vendors are useful but abstract; this one is not. It turns the usual hand-waving about "reduce your exposure" into concrete, checkable hygiene against a setup you'll recognize.
Why it matters: the gap between knowing you should audit your exposed surface and actually doing it is where most homelab compromises live. A narrative account of a real intrusion is the thing that reliably closes that gap — it gives you a checklist derived from an actual failure rather than a generic best-practices list. Expect this to drive the week's discussion; the Lobsters thread is worth skimming for the inevitable "here's what I changed after reading this" replies.
Gitea v1.27.2 is a security release — patch it now. Gitea v1.27.2 ships fixes flagged under SECURITY, including an update to collaborator access mode handling and httpsign. In a self-hosted Git forge, an access-control bug translates directly into unauthorized repository access — which, for most of us, means source code, deployment scripts, and whatever secrets have quietly accumulated in a private repo's history.
Note the pattern here: this follows v1.27.1, which was also security-flagged. Two security releases in quick succession on the same minor line is a signal to stop deferring Gitea upgrades and get onto a current tag. If you're pinning image digests in a compose file (you should be), this is the week to bump the pin.
Linux 7.2 is out. Linus has released the 7.2 kernel, noting that the final week of the cycle was — once again — bigger than he would have wished for. Nobody is running mainline on their NAS the day it drops, but 7.2 sets the baseline that container runtimes, filesystems, and hardware support will inherit as it flows into the next distro cycle. If you've been waiting on support for a specific piece of hardware, the 7.2 coverage at LWN is the place to check whether your wait is over.
New Releases & Updates
- rsync 3.5.0 — A major-version bump with a huge number of security fixes; since rsync underpins most homelab backup scripts and major bumps have historically shifted defaults and protocol behavior, read the NEWS before upgrading both ends of a sync pair (LWN announcement).
- Nextcloud v34.0.3 — The current stable maintenance release, shipped alongside 33.0.8 and 32.0.14 so every supported branch got a fix; this is the routine upgrade most Nextcloud admins should take this week.
- Home Assistant 2026.8.2 — A patch release for the most-deployed app in the space, with integration and unit-conversion fixes (including Teslemetry streamed tyre pressure and isolation resistance) that quietly correct bad sensor data.
- Portainer 2.39.6 LTS — An LTS update to the default Docker management UI for many homelabs; check the documented known issues around Async Edge update schedules and Podman support before rolling it out.
- Traefik v2.11.55 — Continued maintenance on the 2.x line, which still matters because a large share of self-hosters front their stacks with v2 and haven't migrated to v3.
Community Spotlight
If you've ever set up Prometheus plus Grafana for a single box and then quietly stopped looking at it, beszel deserves a look. It's lightweight server monitoring with Docker container stats and historical graphs — a credible low-overhead alternative for people whose monitoring needs are "is the box alive, and what ate my RAM last Tuesday" rather than a full observability pipeline. It surfaced on Lobsters this week, and the appeal is obvious: the monitoring stack shouldn't be the heaviest workload on the machine it's monitoring.
Quick Links
- How we tracked down a 16-year-old SQLite bug — Tailscale walks through a real corruption path that survived 16 years undetected. SQLite backs a huge fraction of self-hosted apps, and this is a genuinely readable debugging story.
- Domas: Bypassing memory protection with AMD's memory controllers — Christopher Domas on defeating memory protection via the memory controller. Firmware-level, not something you patch on a Tuesday, but worth knowing about if you run untrusted workloads on shared hardware.
