On September 9, 2026, Alby disclosed that its self-hosted Lightning wallet Alby Hub shipped, up to v1.18.5, a critical flaw that let an attacker take over an internet-exposed node and move its funds. If you self-host a Lightning node, check your version and close the public exposure before you patch.
On August 31, 2026, Brad Fitzpatrick released tailcat, an open-source Go package and CLI that exposes Tailscale’s data plane — WireGuard, NAT traversal, and DERP — with no account, no IP addresses, and no control plane. Use it to connect two isolated machines, or hand an AI agent a disposable connection, with no root access.
Floppy, an AGPL-3.0 self-hosted media tracker, brings movies, TV, anime, books, games, music and podcasts into one library, with sync for Plex, Jellyfin, Audiobookshelf and Pocket Casts. Anyone who wants their watch history back on their own hardware can run it on a Docker container and a Redis instance.
In August 2026, two designers published ShieldFont, a webfont that renders readable text to humans while feeding a subtly scrambled version to scrapers that pull the raw HTML. For self-hosters running a blog or documentation, it is a nearly free technical defense — at the cost of search and accessibility tradeoffs.
Within a single week, Jellyfin saw three of its most experienced maintainers leave, including long-time project leader Joshua Boniface, who stepped down citing burnout. The project then settled a long-running versioning question and will jump straight to 12.0 — here is what that means for your server.
On August 8, 2026, Metabase disclosed a maximum-severity SQL injection flaw (CVSS 10.0) that was already being exploited in the wild. The vulnerability lets unauthenticated attackers gain administrator privileges and drain every connected database. Self-hosted Metabase admins must patch, revoke sessions, and rotate all secrets immediately.
On August 2, 2026, Gitea shipped a critical fix for CVE-2026-59774, a path traversal that lets an unauthenticated attacker read any server file via Org-mode markup rendering on a public repository. Worse: by reading the INTERNAL_TOKEN from app.ini, the attacker can escalate to remote code execution. Every self-hosted Gitea administrator must patch and rotate secrets immediately.
Proxmox VE 9.2 is now natively available on ARM64 (aarch64), sharing a single package repository with x86-64. Raspberry Pi is not yet officially supported, but RK3588 boards and Apple Silicon Macs are ready today.
Immich 3.1 adds EXIF metadata workflow filters, screen wakelock during web upload, and OIDC role synchronization. The self-hosted Google Photos alternative now ships enterprise-grade identity management.
Changedetection.io hit 32,500 GitHub stars in July 2026 with v0.55.8 adding LLM-powered change filtering and Playwright-based JavaScript rendering. A ten-line Docker Compose file is all it takes to track your competitors’ pricing pages, stock availability, and TOS changes before they even know they changed them.
Zapier charges $30/month for 750 tasks. N8n, running on your own hardware, gives you unlimited executions for zero dollars — and the price never scales with workflow complexity. Here’s the full cost breakdown, the docker-compose, and the verdict.
Miniflux is a Go-based RSS reader shipped as a single sub-20 MB binary with PostgreSQL as its only dependency. Version 2.3.3 hit 9,500 GitHub stars in July 2026 — here’s why this self-hosted minimalist beats FreshRSS on speed, not features.
Authentik has become the default identity provider for self-hosters in 2026, surpassing both Authelia and Keycloak. One Docker Compose file, five minutes of configuration, and every service you run shares the same login, the same MFA, and the same user directory.
Forgejo shipped version 16.0 on July 16, 2026, three and a half years after the community fork from Gitea. A single 100 MB Go binary replaces both GitHub and GitLab on the cheapest VPS money can buy, with GitHub Actions-compatible CI/CD and governance locked under a non-profit foundation.
Uptime Kuma hit 89,600 GitHub stars by July 2026 with v2.1 adding Globalping multi-location checks and domain expiry monitoring. One Docker container, 50 MB of RAM, and 90 notification channels replace Uptime Robot for anyone who already runs a VPS.
On April 29, 2025, Plex doubled its lifetime price to $249.99 and killed free remote streaming. One year later, Jellyfin has crossed 50,000 GitHub stars, 360 million Docker pulls, and 51% market share among self-hosters. If you own a server and a media collection, paying to stream it no longer makes sense.
State of the Open Home 2026 confirmed what the numbers already showed: Home Assistant governs 250+ open-source projects, has 89,500 GitHub stars, and ships a new release every month. If you still trust Google or Amazon with your home automation, you’re paying for the privilege of being the product.
