The self-hosted forge Forgejo shipped versions 16.0.4 and 15.0.8 on September 10 to fix a critical RCE born of template expansion, alongside three authorization flaws that share the same root cause. Everything on 16.0.3 or earlier must be patched, and fine-grained token inventories need a review.
On September 2, 2026, Home Assistant 2026.9 modernizes Modbus so an industrial device can be picked from the UI without writing any YAML, and hardens the instance by passing through the real source IP of Cloud connections so IP banning actually works. Upgrade if you run Modbus gear or expose your instance.
File Browser, the self-hosted web file manager with 36,000 GitHub stars, shipped its last release v2.63.23 on July 27, 2026 and archived its repository on September 1, 2026: no more security fixes will follow. Audit your exposed instances and migrate to a maintained alternative.
Plex ships Plex Media Server 1.43.3 and Plex Desktop 1.115.0 to close several flaws whose CVEs have not yet been published, while Censys counts more than 360,000 web interfaces exposed to the internet. Update server and clients, and check your NAS update channel, which can lag behind.
CVE-2026-16007 is an authenticated SQL injection in AppFlowy Cloud, the open-source Notion alternative: any logged-in user can read, modify, or drop the database. The fix exists only for the commercial tier — the self-hosted edition got no answer from the vendor.
CVE-2026-60004, a critical code-injection flaw in Gitea, has been exploited in the wild since August 25, 2026: an attacker can run shell commands as the forge’s system user. Self-hosted instances with open registration are hit first; the fix comes down to an upgrade and a disable switch.
Version 3.18 of the self-hosted Woodpecker CI platform ships a database migration that reworks log storage — a backup and a maintenance window are recommended before upgrading. It also tightens security: additional and matrix environment variables are no longer injected into plugins automatically.
On August 14, 2026, SimpleX Chat launched an equity crowdfunding round on Wefunder, inviting its users to become shareholders of the self-hostable private messenger. The move exposes the economic fragility of independent encrypted messaging — and a path to funding without ads or data resale.
In early August 2026, Trakt began requiring a $4.99/month VIP subscription to create API applications, and existing keys are vanishing. The self-hosted ecosystem that syncs Plex, Jellyfin and Kodi with Trakt is discovering its dependence on a third-party service that is no longer free.
n8n version 2.35, released August 11, 2026, fixes AI agent context leaks and adds secret redaction for Code nodes. The real signal: selfhosted workflow automation has graduated from hobbyist sandbox to credible alternative to cloud iPaaS for agentic workloads.
The self-hosted ecosystem of **Summer 2026** hits a maturity milestone: tools like **Uncloud** and **Komodo** turn Docker Compose into production orchestration, while third-party API shutdowns force technical self-reliance. The homelab is no longer a lab — it's infrastructure.
In August 2026, the self-hosted ecosystem is undergoing a quiet but decisive shift: compact language models (Gemma 3 1B, quantized Llama 4 3B, Qwen 3 0.5B) now enable local conversational AI on consumer hardware. Here's what's realistic today, what isn't yet, and how to start without blowing your power bill.
Linkding, the self-hosted bookmark manager, hits v1.45 in January 2026 with 11,000 GitHub stars. It replaces Pinboard, Pocket, or your ’read later’ tab graveyard — provided you accept ten minutes of Docker setup and a tagging discipline.
With 43,000 GitHub stars and an imminent v3.0 release that includes an LLM-powered classifier, Paperless-ngx has become the gold standard for self-hosted document management. Here’s why your filing cabinet has no reason to exist in 2026.
