The self-hosted forge Forgejo shipped versions 16.0.4 and 15.0.8 on September 10 to fix a critical RCE born of template expansion, alongside three authorization flaws that share the same root cause. Everything on 16.0.3 or earlier must be patched, and fine-grained token inventories need a review.
On September 2, 2026, Home Assistant 2026.9 modernizes Modbus so an industrial device can be picked from the UI without writing any YAML, and hardens the instance by passing through the real source IP of Cloud connections so IP banning actually works. Upgrade if you run Modbus gear or expose your instance.
On September 9, 2026, Alby disclosed that its self-hosted Lightning wallet Alby Hub shipped, up to v1.18.5, a critical flaw that let an attacker take over an internet-exposed node and move its funds. If you self-host a Lightning node, check your version and close the public exposure before you patch.
File Browser, the self-hosted web file manager with 36,000 GitHub stars, shipped its last release v2.63.23 on July 27, 2026 and archived its repository on September 1, 2026: no more security fixes will follow. Audit your exposed instances and migrate to a maintained alternative.
SourceHut changes its terms of service to prohibit LLM-assisted code, becoming the second major forge to follow Codeberg’s lead. If your project relies on generative AI tooling, prepare a migration to Forgejo or a self-hosted instance.
Plex ships Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to close several flaws whose CVEs have not yet been published, while Censys counts more than 360,000 web interfaces exposed to the internet. Update server and clients, and check your NAS update channel, which can lag behind.
On August 31, 2026, Brad Fitzpatrick released tailcat, an open-source Go package and CLI that exposes Tailscale’s data plane — WireGuard, NAT traversal, and DERP — with no account, no IP addresses, and no control plane. Use it to connect two isolated machines, or hand an AI agent a disposable connection, with no root access.
On September 2, 2026, Proxmox announced around-the-clock enterprise support starting October 19 and the launch of Proxmox North America Inc. in Kingston, Ontario, on the back of a 2.3 million-server installed base. For organizations weighing a move off VMware after Broadcom’s price hikes, the support objection just fell away.
In late August 2026 Cloudflare released EmDash, a TypeScript CMS pitched as the spiritual successor to WordPress, and moved its own blog onto it. The core idea is one mechanism: isolating every plugin in a sandbox with declared permissions, where 96% of WordPress flaws come from plugins.
The monthly 2026.9 release of Home Assistant brings a Matter network map (Wi-Fi and Thread) into the main interface, a Serial panel for USB radios, and a reworked Security dashboard. For the self-hoster, the mesh is no longer opaque: you can finally see why a device keeps dropping.
On August 27, 2026, Backblaze announced that SSE-B2 will automatically encrypt every new object with AES-256 starting September 14, at no extra cost and with no API changes. For self-hosters who back up to B2, encryption at rest stops being a checkbox you have to remember.
On August 27, 2026, Portainer moved its LTS line from 2.39.6 to 2.45.0, consolidating a year of short-term releases. The part that matters is not cosmetic: Pod Security Standards, native Kubernetes RBAC, and scheduled image pruning now live inside the UI.
On August 26, 2026, the Open Home Foundation released the anonymized dataset of its first community survey, gathered from 8,616 Home Assistant users, on Zenodo. The lesson for any self-hosted project: you can do open research without exposing your users, if you anonymize properly.
On 24 August 2026, X Corp served a cease-and-desist on Nitter’s sole developer; by the evening of 25 August, nitter.net was offline and the GitHub repository archived. For self-hosters, the lesson is blunt: an alternative front-end is still a dependency on the platform it bypasses.
CVE-2026-16007 is an authenticated SQL injection in AppFlowy Cloud, the open-source Notion alternative: any logged-in user can read, modify, or drop the database. The fix exists only for the commercial tier — the self-hosted edition got no answer from the vendor.
Floppy, an AGPL-3.0 self-hosted media tracker, brings movies, TV, anime, books, games, music and podcasts into one library, with sync for Plex, Jellyfin, Audiobookshelf and Pocket Casts. Anyone who wants their watch history back on their own hardware can run it on a Docker container and a Redis instance.
Cloudflare published Cloudflare OS, its internal AI agent platform, on 5 August 2026 under Apache-2.0, self-hostable on workerd with local LLMs via Ollama. The security model — zero-initial-access agents and per-resource Gatekeepers — is the real novelty, but the runtime requires a paid Workers plan.
CVE-2026-60004, a critical code-injection flaw in Gitea, has been exploited in the wild since August 25, 2026: an attacker can run shell commands as the forge’s system user. Self-hosted instances with open registration are hit first; the fix comes down to an upgrade and a disable switch.
On April 25, 2026, the minio/minio repository was archived as read-only, cutting the self-hosted S3 server off from new fixes and releases. On August 24, 2026, Docker announced it would maintain MinIO through a paid ELS subscription, forcing self-hosters to decide before their next audit.
Unraid announced that its next major release will replace Slackware, its foundation for roughly twenty years, with Universal Blue’s uCore, an immutable OCI server image built on Fedora CoreOS. Built-in backups, native Docker Compose, and plugin permissions arrive with the architectural shift.
A Tom’s Hardware study shows DDR5 prices climbed 500% in twelve months, with a 128 GB kit reaching $3,399, driven by hyperscaler demand for DRAM. Self-hosters should buy capacity on a two-to-three-year horizon instead of waiting for a drop.
On August 13, 2026, Spotify released Soloist, an official headless Spotify Connect client for Raspberry Pi and Linux, with a local WebSocket API for DIY integrations. Homelabbers who patched together unofficial clients now have a supported path — with strings attached.
An IEEE study published in August 2026 analyzes 443,156 Backblaze drives across 1.66 million drive-years and corrects for age bias: under comparable conditions, HGST and WD fail about half as often as Seagate and Toshiba. For a NAS or homelab, the lesson is less about brand than about temperature and capacity.
The Proxmox VE 8 branch, released in June 2023 on Debian 12, reaches end of life in August 2026: hypervisor patches stop even though Debian LTS continues. For anyone running Ceph or old containers, the VE 9 upgrade is two separate projects — and a rollback that goes through restore, not reverse migration.
In August 2026, two designers published ShieldFont, a webfont that renders readable text to humans while feeding a subtly scrambled version to scrapers that pull the raw HTML. For self-hosters running a blog or documentation, it is a nearly free technical defense — at the cost of search and accessibility tradeoffs.
On August 14, 2026, SimpleX Chat launched an equity crowdfunding round on Wefunder, inviting its users to become shareholders of the self-hostable private messenger. The move exposes the economic fragility of independent encrypted messaging — and a path to funding without ads or data resale.
Over six months, Tailscale hit nineteen corruption incidents caused by a sixteen-year-old data race in SQLite’s WAL-reset path. If you self-host SQLite-backed apps, check the bundled version and stay on the beaten path.
The Human-Centered Computing Foundation has filed its application with ICANN for the .self top-level domain, a namespace designed for self-hosted, human-centered projects. Behind the symbol, the real question is what a domain name can actually guarantee — and whether .self will serve self-hosters or mark them as targets.
On August 9, 2026 Planka shipped version 2.2.0, which removes OIDC/SSO from the community edition and deactivates the accounts that depended on it. Before you upgrade, create a local admin account or you risk locking yourself out of your own instance.
Within a single week, Jellyfin saw three of its most experienced maintainers leave, including long-time project leader Joshua Boniface, who stepped down citing burnout. The project then settled a long-running versioning question and will jump straight to 12.0 — here is what that means for your server.
On August 12, 2026 ESPHome launched its Starter Kit, the first official hardware product in the Open Home Foundation ecosystem. It promises local smart devices with no soldering and no code, and marks self-hosting’s entry into consumer hardware.
In early August 2026, Trakt began requiring a $4.99/month VIP subscription to create API applications, and existing keys are vanishing. The self-hosted ecosystem that syncs Plex, Jellyfin and Kodi with Trakt is discovering its dependence on a third-party service that is no longer free.
n8n version 2.35, released August 11, 2026, fixes AI agent context leaks and adds secret redaction for Code nodes. The real signal: selfhosted workflow automation has graduated from hobbyist sandbox to credible alternative to cloud iPaaS for agentic workloads.
The self-hosted ecosystem of **Summer 2026** hits a maturity milestone: tools like **Uncloud** and **Komodo** turn Docker Compose into production orchestration, while third-party API shutdowns force technical self-reliance. The homelab is no longer a lab — it's infrastructure.
Oracle is cutting the Always Free ARM quota from 4 OCPU / 24 GB to 2 OCPU / 12 GB starting August 18, 2026. If you self-host services on Oracle Cloud's free tier, you have nine days to resize or consolidate your instances before they are automatically terminated.
On August 2, 2026, Gitea shipped a critical fix for CVE-2026-59774, a path traversal that lets an unauthenticated attacker read any server file via Org-mode markup rendering on a public repository. Worse: by reading the INTERNAL_TOKEN from app.ini, the attacker can escalate to remote code execution. Every self-hosted Gitea administrator must patch and rotate secrets immediately.
Proxmox VE 9.2 is now natively available on ARM64 (aarch64), sharing a single package repository with x86-64. Raspberry Pi is not yet officially supported, but RK3588 boards and Apple Silicon Macs are ready today.
In August 2026, the self-hosted ecosystem is undergoing a quiet but decisive shift: compact language models (Gemma 3 1B, quantized Llama 4 3B, Qwen 3 0.5B) now enable local conversational AI on consumer hardware. Here's what's realistic today, what isn't yet, and how to start without blowing your power bill.
Immich 3.1 adds EXIF metadata workflow filters, screen wakelock during web upload, and OIDC role synchronization. The self-hosted Google Photos alternative now ships enterprise-grade identity management.
FFmpeg 9.0 landed on August 3, 2026 with expanded Vulkan acceleration, an Animated WebP decoder, and an ONNX Runtime backend. Here's what this major release actually changes for your self-hosted media stack.
On July 31, 2026, the Arch Linux project disabled AUR package adoption following the malicious takeover of over 200 packages. The malware, a Rust-based infostealer with SSH worm capabilities, uses Tor for C2 and targets crypto wallets, cloud secrets, and API keys.
File Browser is shutting down on September 1, Bitwarden broke Vaultwarden compatibility, and Codeberg banned vibe-coded projects. Here is what self-hosting operators need to know and what to do about it.
Released July 30, 2026, NetBSD 11.0 is the first stable BSD with RISC-V support, introduces a MICROVM kernel that boots in 10 ms, and deepens Linux binary compatibility with epoll, clone3, and inotify. It ships with three documented security advisories — and that’s the most honest thing an OS has done in years.
Immich shipped version 3.0 on 2 July 2026, nine months after its first stable release and weeks after a two-year retrospective on its backing by nonprofit FUTO. It replaces Google Photos once you can afford roughly $300 of hardware and a disciplined off-site backup — skip either, and the migration trades Google’s reliability for a real chance of losing everything.
Coolify shipped version 4.2.0 on July 21, 2026, and now sits at 59,800 GitHub stars. This open-source PaaS deploys your apps, databases, and 280 services to any Linux server with a single click — no per-GB billing, no bandwidth caps, no lock-in.
Linkding, the self-hosted bookmark manager, hits v1.45 in January 2026 with 11,000 GitHub stars. It replaces Pinboard, Pocket, or your ’read later’ tab graveyard — provided you accept ten minutes of Docker setup and a tagging discipline.
Changedetection.io hit 32,500 GitHub stars in July 2026 with v0.55.8 adding LLM-powered change filtering and Playwright-based JavaScript rendering. A ten-line Docker Compose file is all it takes to track your competitors’ pricing pages, stock availability, and TOS changes before they even know they changed them.
Zapier charges $30/month for 750 tasks. N8n, running on your own hardware, gives you unlimited executions for zero dollars — and the price never scales with workflow complexity. Here’s the full cost breakdown, the docker-compose, and the verdict.
Dozzle weighs 4 MB, stores nothing, and streams Docker logs in real time from your browser. v10.6.13 shipped July 27, 2026 with an adaptive ANSI palette and an embedded SQL engine: if your only log tool is still the terminal, you’re bleeding time every single day.
Released on 21 May 2026, Proxmox VE 9.2 ships with a dynamic load balancer, WireGuard as an SDN fabric protocol, Ceph Tentacle, and kernel 7.0. Two years into the post-Broadcom exodus, the balance of power has definitively shifted.
With 87,000 GitHub stars and v2.1.2 released in July 2026, Syncthing proves that P2P end-to-end encrypted sync can replace Dropbox — no central server, no subscription. If your files still cross the Atlantic to move between two machines on the same desk, it’s time to stop.
Datadog charges $15 per host per month for infrastructure, $31 for APM, and $0.10 per gigabyte of ingested logs. Grafana, Prometheus, Loki, and node_exporter deliver the same coverage on a single Docker Compose stack, on Linux or Windows, for the cost of hardware and electricity.
CrowdSec blocks 80% of malicious IPs before they reach your logs by pooling attack signals across 14,000 community nodes. It outperforms Fail2ban on everything except single-server SSH protection.
Miniflux is a Go-based RSS reader shipped as a single sub-20 MB binary with PostgreSQL as its only dependency. Version 2.3.3 hit 9,500 GitHub stars in July 2026 — here’s why this self-hosted minimalist beats FreshRSS on speed, not features.
Portainer 2.39.5 LTS shipped on July 13, 2026, and STS 2.43 brings native Kubernetes RBAC. The Business Edition is free for 3 nodes with no time limit, including RBAC, GitOps, and full audit logging. For any homelab up to three machines, it’s a no-brainer; beyond that, the cost pays for itself the moment you have a team.
Authentik has become the default identity provider for self-hosters in 2026, surpassing both Authelia and Keycloak. One Docker Compose file, five minutes of configuration, and every service you run shares the same login, the same MFA, and the same user directory.
Traefik v3.7.0, released May 5 2026, takes the reverse proxy to its logical conclusion: it reads your Docker container labels, provisions Let’s Encrypt certificates, and routes traffic without a single static config file. If Nginx Proxy Manager got your foot in the door, Traefik is the next step — the one where you stop configuring your reverse proxy and let it discover your services for you.
IT-Tools packs over 80 developer utilities into a single stateless web page. It ships in a 29 MB Docker image and runs with zero configuration: if you’re still googling « base64 decode online » five times a week, you’re wasting time and leaking data.
WireGuard has been in the Linux kernel since March 2020, Tailscale crossed $100M ARR in early 2026, and Headscale has passed 42,000 GitHub stars. If you self-host more than two services, a free or self-controlled mesh VPN transforms remote access without a single firewall rule.
Forgejo shipped version 16.0 on July 16, 2026, three and a half years after the community fork from Gitea. A single 100 MB Go binary replaces both GitHub and GitLab on the cheapest VPS money can buy, with GitHub Actions-compatible CI/CD and governance locked under a non-profit foundation.
Uptime Kuma hit 89,600 GitHub stars by July 2026 with v2.1 adding Globalping multi-location checks and domain expiry monitoring. One Docker container, 50 MB of RAM, and 90 notification channels replace Uptime Robot for anyone who already runs a VPS.
Nginx Proxy Manager v2.14.0 turns reverse proxy configuration into three web forms and a Save button. Let’s Encrypt, redirects, and TCP/UDP streams come built in. If Traefik intimidates you and Caddy bores you, NPM is the answer.
Nextcloud Hub 10 launched on February 25, 2025 with 400 apps, a self-hosted AI Assistant, and 6× faster uploads. At €12 per user per month on Google Workspace, the open-source suite pays for itself from month one on a €6 VPS.
Actual Budget, the open-source fork of YNAB 4, shipped version 26.7.0 on July 2, 2026. This envelope-budgeting finance manager does everything YNAB does — budgets, OFX imports, multi-device sync — without the $14.99 monthly charge.
On April 29, 2025, Plex doubled its lifetime price to $249.99 and killed free remote streaming. One year later, Jellyfin has crossed 50,000 GitHub stars, 360 million Docker pulls, and 51% market share among self-hosters. If you own a server and a media collection, paying to stream it no longer makes sense.
Pi-hole v6 and AdGuard Home 0.107.77 are both thriving in 2026, but the comparison has shifted. Native encrypted DNS, per-client rules, and built-in parental controls make AdGuard Home the clear choice for new deployments. If you’re starting today, the gap isn’t close.
In 2026, Ollama and Open WebUI let you run a capable LLM at home without an engineering degree. A Mac Mini M4 with 24 GB of unified memory runs 32B models at Q4, and the break-even point against a ChatGPT Plus subscription lands between 18 and 36 months depending on the hardware you pick.
Vaultwarden 1.37.0, released July 24, 2026, is a complete Rust rewrite of the Bitwarden server that sips 50 MB of RAM while the official server gulps 2 GB. If your passwords run on your own hardware, you have exactly zero rational reasons left to use the official Bitwarden server.
State of the Open Home 2026 confirmed what the numbers already showed: Home Assistant governs 250+ open-source projects, has 89,500 GitHub stars, and ships a new release every month. If you still trust Google or Amazon with your home automation, you’re paying for the privilege of being the product.
With 43,000 GitHub stars and an imminent v3.0 release that includes an LLM-powered classifier, Paperless-ngx has become the gold standard for self-hosted document management. Here’s why your filing cabinet has no reason to exist in 2026.
