FR
live
section

Self-hosted

FileBrowser Quantum 2.0 adds activity logs and per-source permissions

The FileBrowser Quantum fork reached 2.0 stable on October 9, 2026 with an activity log, per-storage-source permissions, and a BoltDB-to-SQLite migration, followed on October 13 by a fix for two security flaws. Prepare a real migration procedure before upgrading your 1.x instances.

Plex2Shell: the Plex Media Server exploit chain went from PoC to crypto mining in 24 hours

On October 16, 2026, researcher Zach Main published Plex2Shell, a chain of four flaws — CVE-2026-96652, 96654, 96655 and 96656 — enabling unauthenticated remote code execution on Plex Media Server. By October 17, attackers were deploying an XMRig miner and a residential proxy on exposed servers: update to 1.43.3.10861 and take Plex off the public internet.

Seafile 14 adds an AI chat that answers over your own libraries

On 14 October 2026, the Seafile team opened testing for version 14.0, headlined by AI Chat — an assistant that explores your libraries through their metadata — and SeaSearch, a full-text and vector search engine now set as the default. Try it on a throwaway instance first: self-hosted does not mean the AI runs locally.

Sonarr opens the v5 beta and replaces basic auth with OIDC

On 12 October 2026, Sonarr announced the v5 beta, its first major release in nearly two years, with a rebuilt interface, OIDC authentication, and blocking of malicious file extensions in torrents. If your instance is exposed behind a reverse proxy, v5 is the right excuse to finally move to real authentication.

Immich 3.3 speeds up its AI inference and cuts RAM with one opt-in environment variable

On October 7, 2026, Immich shipped version 3.3, which introduces an opt-in revision of its machine learning models: MACHINE_LEARNING_MODEL_REVISION=v2 makes inference significantly faster and less memory-hungry across every backend, including CPU. If your photo NAS is running tight, this is the variable to add — but understand what it changes first.

Nabu Casa renames Home Assistant Cloud to Home Assistant Link

On October 2, 2026, Nabu Casa announced it is renaming Home Assistant Cloud to Home Assistant Link, effective in the December release. The service itself is unchanged — what is being removed is the word ‘cloud’, deemed too tainted by Big Tech, and that is a signal for the whole self-hosted ecosystem.

The Dutch tax office abandons Microsoft 365 and brings email and calendars on-premises in 2027

On October 7, 2026, the Dutch State Secretary for Finance announced that the Tax and Customs Administration is dropping its Microsoft 365 migration: email and calendars move on-premises in 2027, with European open source for storage and collaboration to follow. For European IT leaders, it is the most concrete signal yet that sovereignty is no longer a slogan but a budgeted trajectory.

Unraid and 45HomeLab’s X4 sells a turnkey home server for $1,199

Unraid and 45HomeLab have opened pre-orders for the X4, a pre-assembled four-bay home server shipped with Unraid OS pre-installed, starting at $1,199 and delivering in October 2026. For anyone torn between building their own box and buying a locked-down NAS, that price defines a third path — provided you read the trade-offs.

The Pinchflat-ngx fork picks up the YouTube manager its maintainer left behind

Pinchflat, the self-hosted YouTube download manager, has seen no activity for about ten months; a fork, Pinchflat-ngx, is carrying the project forward with 808 commits and adds PostgreSQL, OIDC and NAS-friendly disk staging. If you already archive channels, switching to the latest image is low-risk, but the PostgreSQL path is a reinstall, not an upgrade.

Plex adds Boost Dialog and loudness normalization in Plex Media Server 1.43.4

On September 15, 2026, Plex shipped two Plex Pass audio options: Boost Dialog, which lifts the frequencies where voices live, and Normalize Loudness, which evens out volume swings. The loudness analysis that powers them runs on your CPU during maintenance, so measure the cost before you turn it on for a large library.

Stirling PDF 3.0 adds a document automation engine and makes SSO free

On September 24, 2026, Stirling PDF shipped version 3.0, which introduces a PDF Processor that automates batch processing from folders, FTP, or S3, and makes OAuth SSO free for everyone. For a self-hoster who moves documents in volume, the tool graduates from a single-file editor to an automation platform.

Raspberry Pi locks Pi 5 RAM in firmware to stop fraudulent resellers

On 21 September 2026, Jeff Geerling documented a firmware lock, introduced in late 2024, that prevents swapping the RAM chips on a Raspberry Pi 5. The move targets resellers who modify entry-level boards, but it also removes the right to repair and upgrade your hardware.

The self-hosted community unmasks the developer of BookOrbit

On September 18, 2026, the self-hosted community identified the developer of BookOrbit — a self-hosted reading platform with about 4,600 GitHub stars — as the creator of Booklore, a twin project that disappeared after being called out for code quality, contributor mistreatment, and license abuse. Before deploying software you run yourself, verify author continuity, the license, and community history.

Bitwarden’s self-hosted container finally runs rootless and read-only

Version 2026.8.1 of Bitwarden’s self-host repository adds long-requested support for running the unified container fully rootless and with a read-only root filesystem, and 2026.8.2 follows up with cap_drop: ALL. If you self-host the password manager, upgrade now and re-check your Docker Compose before a container escape turns a missed patch into a vault theft.

Papermerge shifts its focus to SaaS, its open-source edition hunting for maintainers

After nine years of open-source development, the Papermerge document management system is splitting in two: a SaaS launching on November 11, 2026, and a self-hosted edition whose author is now “seeking maintainers” while he transitions to the cloud. If your archive runs on Papermerge, plan a migration instead of waiting to see what happens next.

Jellyfin 12.0 ships to polish the 10.11 rewrite and demands a full rescan

On September 8, Jellyfin released version 12.0, which drops the “10.” prefix and concentrates most of its work on the performance inherited from the 10.11 rewrite. The migration changes the database with no way back: backup, plugin removal, and a full library scan are mandatory before you reap the gains.

Home Assistant 2026.9 opens the Modbus bus and tightens its security surface

On September 2, 2026, Home Assistant 2026.9 modernizes Modbus so an industrial device can be picked from the UI without writing any YAML, and hardens the instance by passing through the real source IP of Cloud connections so IP banning actually works. Upgrade if you run Modbus gear or expose your instance.

File Browser is archived and will receive no more security fixes

File Browser, the self-hosted web file manager with 36,000 GitHub stars, shipped its last release v2.63.23 on July 27, 2026 and archived its repository on September 1, 2026: no more security fixes will follow. Audit your exposed instances and migrate to a maintained alternative.

SourceHut Bans LLM-Generated Code, Following Codeberg

SourceHut changes its terms of service to prohibit LLM-assisted code, becoming the second major forge to follow Codeberg’s lead. If your project relies on generative AI tooling, prepare a migration to Forgejo or a self-hosted instance.

Tailcat ships Tailscale’s WireGuard data plane with no control plane at all

On August 31, 2026, Brad Fitzpatrick released tailcat, an open-source Go package and CLI that exposes Tailscale’s data plane — WireGuard, NAT traversal, and DERP — with no account, no IP addresses, and no control plane. Use it to connect two isolated machines, or hand an AI agent a disposable connection, with no root access.

Proxmox moves enterprise support to 24/7 and opens a North American subsidiary

On September 2, 2026, Proxmox announced around-the-clock enterprise support starting October 19 and the launch of Proxmox North America Inc. in Kingston, Ontario, on the back of a 2.3 million-server installed base. For organizations weighing a move off VMware after Broadcom’s price hikes, the support objection just fell away.

ShieldFont poisons AI scrapers with nothing more than a font

In August 2026, two designers published ShieldFont, a webfont that renders readable text to humans while feeding a subtly scrambled version to scrapers that pull the raw HTML. For self-hosters running a blog or documentation, it is a nearly free technical defense — at the cost of search and accessibility tradeoffs.

HCCF submits its bid to ICANN for the .self domain, a TLD built for self-hosting

The Human-Centered Computing Foundation has filed its application with ICANN for the .self top-level domain, a namespace designed for self-hosted, human-centered projects. Behind the symbol, the real question is what a domain name can actually guarantee — and whether .self will serve self-hosters or mark them as targets.

Jellyfin loses three core maintainers in a week and renumbers its releases

Within a single week, Jellyfin saw three of its most experienced maintainers leave, including long-time project leader Joshua Boniface, who stepped down citing burnout. The project then settled a long-running versioning question and will jump straight to 12.0 — here is what that means for your server.

Gitea CVE-2026-59774 — Unauthenticated CVSS 9.8 File Read Escalates to RCE on Every Self-Hosted Instance

On August 2, 2026, Gitea shipped a critical fix for CVE-2026-59774, a path traversal that lets an unauthenticated attacker read any server file via Org-mode markup rendering on a public repository. Worse: by reading the INTERNAL_TOKEN from app.ini, the attacker can escalate to remote code execution. Every self-hosted Gitea administrator must patch and rotate secrets immediately.

Immich replaces Google Photos once you budget for a mini PC and real backups

Immich shipped version 3.0 on 2 July 2026, nine months after its first stable release and weeks after a two-year retrospective on its backing by nonprofit FUTO. It replaces Google Photos once you can afford roughly $300 of hardware and a disciplined off-site backup — skip either, and the migration trades Google’s reliability for a real chance of losing everything.

Syncthing syncs your files without routing them through California

With 87,000 GitHub stars and v2.1.2 released in July 2026, Syncthing proves that P2P end-to-end encrypted sync can replace Dropbox — no central server, no subscription. If your files still cross the Atlantic to move between two machines on the same desk, it’s time to stop.

Authentik Locks Every Self-Hosted Service Behind One Password

Authentik has become the default identity provider for self-hosters in 2026, surpassing both Authelia and Keycloak. One Docker Compose file, five minutes of configuration, and every service you run shares the same login, the same MFA, and the same user directory.

Traefik doesn’t get configured — it discovers your Docker containers and gives them HTTPS before you lift a finger

Traefik v3.7.0, released May 5 2026, takes the reverse proxy to its logical conclusion: it reads your Docker container labels, provisions Let’s Encrypt certificates, and routes traffic without a single static config file. If Nginx Proxy Manager got your foot in the door, Traefik is the next step — the one where you stop configuring your reverse proxy and let it discover your services for you.

Forgejo Runs Your Code Forge on 100 MB of RAM and Nobody Owns It

Forgejo shipped version 16.0 on July 16, 2026, three and a half years after the community fork from Gitea. A single 100 MB Go binary replaces both GitHub and GitLab on the cheapest VPS money can buy, with GitHub Actions-compatible CI/CD and governance locked under a non-profit foundation.

Jellyfin Is the Netflix Alternative That Answers to No One

On April 29, 2025, Plex doubled its lifetime price to $249.99 and killed free remote streaming. One year later, Jellyfin has crossed 50,000 GitHub stars, 360 million Docker pulls, and 51% market share among self-hosters. If you own a server and a media collection, paying to stream it no longer makes sense.

Vaultwarden replaces Bitwarden everywhere you self-host your passwords

Vaultwarden 1.37.0, released July 24, 2026, is a complete Rust rewrite of the Bitwarden server that sips 50 MB of RAM while the official server gulps 2 GB. If your passwords run on your own hardware, you have exactly zero rational reasons left to use the official Bitwarden server.

Type at least two characters.

↑ ↓ navigate ↵ open esc dismiss