The Homelab Fixer

Plex said it out loud this week: "These vulnerabilities are being actively and widely exploited." The exploit chain — Plex2Shell — has a public proof of concept and a payload your electricity bill will notice: compromised servers become crypto miners and someone else's proxy exit node , routing strangers' traffic through your home connection. The twist that makes this a homelab story: the fix has existed since August 4 . Plex shipped it quietly, urged everyone to update on September 1, and waited six weeks while most self-hosters never applied it. Then the PoC dropped October 16, exploitation was observed October 17, and CISA added all four CVEs to its Known Exploited Vulnerabilities catalog on October 20 — today is the remediation deadline for two of them. This is the operator's runbook: check exposure, patch every install type (including the NAS and Docker traps), and decide whether patching is enough or your server needs a clean rebuild. How this was ...

The only sane advice this week: patch tonight . On Wednesday, October 21, 2026, Node.js shipped security releases for the 26.x, 24.x and 22.x lines. By Thursday, a working proof of concept was public — researchers had demonstrated remote code execution on the official Node.js 24.22.0 Docker image using crafted Brotli data. Today, The Hacker News carried the story wider. The vulnerability has a nickname now: Node2Shell . If you self-host, this one matters more than most Node advisories. Node.js isn't just a runtime on your server — it is inside your containers. Your dashboards, automation and media tooling ship a Node runtime that a host package audit won't find. This guide is a runbook: find every Node in your stack, then fix each one — including the three traps that catch self-hosters. Honest-testing note: We did not reproduce any exploit — no exploit or PoC instructions here, only defensive checks. Every fact below is quoted or derived from the official Node.js advis...

On October 21, 2026 , GitLab shipped a critical patch release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for Community and Enterprise Edition. The headline fix is CVE-2026-110264 — an integer overflow in the regex compiler that, in GitLab's own words, "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server ." Severity: Critical, CVSS 10.0 . Every self-hosted GitLab from version 7.0 onward is exposed unless it's on a fixed build. This is the operator's version of the story: which build your line needs, how to back up first, the Docker and Omnibus upgrade path, the migration-downtime trap on 19.4.x, and what to do if you can't patch tonight. Same patch-tonight discipline as our php2shell emergency RCE playbook — different stack, same urgency. ⚠️ Honest testing note. We did not reproduce an exploit in a lab — deliberately. Every fact below is quoted or derived from GitLab's official patch rele...

  On October 20, 2026 , the FBI, CISA, the US Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz, the UK's National Crime Agency and the UK's North West Regional Organised Crime Unit published joint advisory AA26-293A on the SafePay ransomware group — active since August 2024, with 600+ critical infrastructure victims across North America, South America, Europe and Australia. "SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors," said Brett Leatherman, assistant director of the FBI's cyber division. The coverage treats it as enterprise news — but the detail that matters for homelabs is buried: SafePay halts the Volume Shadow Copy Service and factory-resets NAS devices holding backups . Investigators found cases where every company NAS backup was deleted before encryption began. Your NAS isn't collateral damage here — it's the target. Below: what SafePay does, why homelabs ar...

Today, October 21, 2026 , PHP shipped an emergency security release for two critical unauthenticated remote code execution flaws — CVE-2026-109618 and CVE-2026-109619 , CVSS v4.0 9.2 each, nicknamed php2shell . Fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35 — every number verified against php.net's security advisory . If you self-host PHP apps — Nextcloud, WordPress, Drupal, WooCommerce, phpMyAdmin — this is your most urgent patch of the year. If you update PHP in WordPress through your host's panel, note that only the web SAPI changes — CLI cron jobs may still run the old binary, so verify both after the switch. The bug sits in PHP's core request handling, below your application: php.net confirms an unauthenticated exploit that fires on mod_php before any application code runs. Sansec warns of mass attacks within 15 minutes. Below: the 30-second check, Docker and bare-metal fixes, TrueNAS and Proxmox LXC notes, the EOL survival plan, and the post-patch sweep. ⚠️ Honest...

n8n 3.0 is expected in October 2026, according to the official 3.0 breaking-changes page — it is not released yet ; the newest version as of October 20, 2026 is the 2.45.0 pre-release ( GitHub releases ). If you self host n8n on your own hardware — a mini-PC, a NAS, a Pi in the cupboard — this release decides how you'll run it: npm and npx installs stop being supported; self-hosted n8n goes Docker-only. Legacy nodes and helpers are removed, and several defaults change in ways that break workflows silently. This n8n upgrade guide covers the n8n 3.0 breaking changes the VPS-centric write-ups skip: find what breaks on your instance, move off npm with a docs-verified n8n docker install migration, and fix every removal before n8n 3.0 lands. ⚠️ Honest testing note. We did not run this migration live — n8n 3.0 isn't out, so nobody outside n8n has. Every step is verified against the official 2.x docs and the published 3.0 breaking-changes page; anything that could chang...