Self-Host Weekly (23 October 2026)

Self-Host Weekly (23 October 2026)

Shell shocked

SPONSORED BYInfisical

Weekly Highlights

This week, two critical PHP vulnerabilities (dubbed PHParr PHP2SHELL) that could allow code to be remotely executed on servers were leaked ahead of their planned patches, causing a portion of the internet to blip on Wednesday. PHP quickly moved up the patch releases in response.

If you deploy PHP-based applications (handy list of apps here), you should update them ASAP (Unraid, too!).

In other news and activity:

• My annual self-host user survey officially crossed 5,000 responses and will remain open until October 31st for those who haven't completed it yet
• Plex reportedly laid off their player development team, and the now former employee who shared the news had some (now removed) advice for users (see also: PLEX2SHELL)
• Linus Torvalds made his first (known) AI-assisted contribution to the Linux kernel
• The Omnivore team reminded everyone that – despite the platform shutting down last year – it can still be self-hosted
• OpenBSD 8.0 was released, which brings new GPU support, ARM64 hibernation support, wireless network driver improvements, and more to the platform
• A new non-root local server for Roborock vacuums has been making its rounds
• CleanYourTV, a tool for debloating Android-based TVs, went viral on social media
• Somebody developed a version of the Destroy Any Website game for Jellyfin
• Users successfully reverse-engineered Blender and published it as an open source project called BlenderCraft (note: Blender has been open source since 2002)

Happy selfh.st/ing!

Newswire

Linus Torvalds posts his first AI-assisted patch to the Linux kernel, synthetic test clocks 23x performance leap — the bossman makes use of AI tooling himself after issuing clear pro-AI directives

That seemingly didn't stop the pro- and against-AI camps in the kernel from continuing to bicker, though.

Tom's Hardware •Bruno Ferreira

Postgres 19 delayed after AI reviewers find more bugs than humans can fix

Core devs revert up to 10 features, push release to November, and blame better tooling rather than vibe coding

theregister •Lindsay Clark

Fandango And Plex Team To Integrate Movie Ticket Sales Into Streaming

Streaming platform Plex has teamed with Fandango to allow U.S. users to find showtimes and buy movie tickets as they br…

Deadline •Dade Hayes

How to take back your voice

From smart speakers to meetups, this month is all about voice: how to take yours back from Big Tech, and where to be he…

Building the Open Home •Paulus Schoutsen

5.0: A closer look

October is here, and it's almost time for Mastodon's 5.0 release! We announced our plans for big changes back in August…

Mastodon Blog

Software Updates

• Arcane v2.17.0 | Deployment: Native Podman support, hostname configuration, delay option for new image auto-updates
• Bichon v2.2.0 | Archive: Local directory backup targets, search by envelope ID, filter by items missing tags, system theme toggle, blob repair
• DVinyl v3.3.0 | Tracking: Redesigned for mobile access, optional AI assistant, copy items to new entry, distinct titles count
• Endurain v0.20.0 | Fitness: New backend foundation, replaced Apprise email with jasil, new variables, breaking API changes
• GeoPulse v2.0.0 | Location: Localization, refreshed interface, new navigation menus, Home Assistant integration, API token scopes
• GoCron v0.14.0 | Task Scheduling: Proper sign-in page, local logout, consistent tab titles
• Karakeep v0.34.0 | Read Later: Updated auth library, automatic offline downloads, mobile app improvements, more robust crawler, broken links revamp
• LibreDB Studio v1.0.0 | Database: New control plane for governance, twelve new connection types, agent mode enhancements
• MyBibliotheca v3.0.0 | Books: Migrated to PostgreSQL as default database, Redis support, Google Books API support
• OpenSign v3.0.0 | Document Signing: Support for qualified electronic signatures, API token status information, redesigned interface
• Pangolin v1.25.0 | Remote Access: Redirects, mTLS authentication for public resources, machine client roles
• Pocket ID v2.19.0 | Authentication: Configurable login notification modes, searchable and sortable apps, force email verification
• qBittorrent v5.3.0 | Downloads: Match all share limits, widely used image types, ban IP ranges, logged IP ban alerts, new torrent list filters
• Rallly v4.16.0 | Event Polls: Add video conference links (Meet, Zoom, Teams, or Webex) to polls, poll finalization, plain yes/no polls, refreshed interface
• SuggestArr v3.0.0 | *arr: Rebuilt frontend from scratch, request expiry, MDBList and Trakt list imports, annual recap and personal journey, light/system themes
• Tracearr v3.0.0 | *arr: Download tracking, Telegram notifications, stream maps

New Software

• Better Status Page | Monitoring: Monitoring and status page in a single container
• DMKaraoke | Music: Lightweight karaoke web app with synced lyrics via machine learning
• Gofer | Email: Multi-account webmail client with contacts, calendar, and Gmail/Outlook integrations
• Handheld Hub | Gaming: Dashboard, catalogue, and sync platform for handheld gaming devices
• Helpdock | Support / Ticketing: Customer support and ticketing platform
• Hotly | Messaging: Paid inbox for communicating with fans
• Jotter | Note-Taking: Minimal scratchpad for capturing thoughts and accessing them across devices
• Kept | Inventory Management: Open source inventory of everything you own and where it is
• Merran | Meal Planning: Meal planning, recipes, and shopping list platform
• Plekt | Media Streaming: Watch history and play state sync across Plex, Jellyfin, Emby, and Trakt
• ROMarr | *arr: *arr download and management app for games
• Stars Organizer | Tracking: Search, tag, rate, and sort GitHub stars into lists
• TubeHaus | Videos: Front end for Invidious that mimics the functionally and appearance of classic YouTube
• Velocity | Tracking: Flight and ship tracker via public feeds
• Wisp | Messaging: Lightweight web-based WhatsApp companion app
• Yarrtube | Videos: Minimal and lightweight YouTube video downloads and streaming

Trending

• Haven | Messaging: Private chat and Discord alternative
• HealthLog | Health and Wellness: Privacy-first health tracking
• Pinchflat-ngx | Videos: Enhanced YouTube media manager
• Silo | Media Streaming: Media server built on a modern stack
• Teampass | Password Manager: Collaborative secrets and credentials vault

Project Updates

Weekly Puzzle

Feedback

Content Spotlight

Meet PatchMon, a self-hosted Linux patch monitoring platform. With PatchMon, users can easily monitor a fleet of Linux machines for security patches and deploy them directly from a web-based dashboard. Features include agents for remote deployments, one-click approvals, scheduled patches, selective patching, Docker monitoring, patch history, and audit logs.

PatchMon can be easily deployed via Docker and requires external PostgreSQL and Redis services for data storage and background job queues.

Links: Website, Source Code

Overheard Online

Videos and Podcasts

• I Built a Home Server That Saves Thousands in Subscriptions | Switch and Click
• HomeCenter: The Self-Hosted Home Manager You Didn’t Know You Needed | DB Tech
• What Do You Keep When You Cancel Your AI Subscription? | Lawrence Systems
• Homarr v2 Changes Everything (Custom Widgets, AI Assistant, MCP) | Servers@Home
• OPNsense Must-Haves: Settings & Plugins You Should Enable | Christian Lempa
• Every Unraid Server Needs These 7 Apps | AlienTech42
• Incus Commander - Open Source Virtual Machine Control Center | Awesome Open Source

Command Line Corner

Press the . key while holding Alt to cycle through and reuse arguments from previous commands:

$ docker compose up -d some-docker-container
$ docker compose stop <Alt .>
$ docker compose stop some-docker-container

Executive Sponsors

Thanks to following executive sponsors, whose continued support makes this newsletter possible:

• AFFiNE – Privacy-first knowledge base
• Atria – Event management and networking platform
• Dawarich – Location history tracking and insights
• Docktail – Unleash your containers as Tailscale Services
• Faved – Handcrafted minimal bookmark manager
• FFXF – Canada-based VPS hosting, built for self-hosters
• FileRun – Like Google Drive, but on your own server
• GetRealIP – Host your services with real, public, static IPs over any ISP
• HealthLog – Privacy-first health tracking
• Karakeep – The bookmark everything app
• Komodo – Build and deploy software across servers
• Rasputin – Homelab cluster OS and control plane
• Seamside – Small internet made from your people's devices
• Servers@Home – Homelab resources and community
• Terrakata – Specialized software tools for the energy industry
• tirreno – Security framework
• Uncloud – Multi-node Docker Compose for production
• Will Be Done – Offline-first task manager built around a visual weekly timeline
• Wintertrace – Winter service and snow removal tracking

Submit Content

I'm always looking for new and existing self-hosted content to share in Self-Host Weekly. Submit the form below if you'd like to have your own content featured or have a suggestion for content types you'd like to see featured in future newsletters.

Subscription details

You are receiving this because you are a free subscriber to selfh.st.