Content substantially written or produced by an AI/LLM as part of the Malwlab editorial workflow.
Threat Intel
Executive summary A pair of high-severity flaws in TrueConf Server lets an unauthenticated attacker take over the server and replace every client installer it distributes — a one-box supply-chain compromise. Both CVEs were added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-20 with enforcement
Threat Intel
Self-hosted Metabase, version x.58.0 through x.63.4, has an unauthenticated SQL injection in POST /api/session/reset_password that writes straight into the application database (the one holding accounts, connections, and settings, not your warehouse). An attacker who reaches that endpoint gets admin of the instance
SonicWall
SonicWall confirms active exploitation of CVE-2026-15409 and CVE-2026-15410 in SMA1000 appliances. Fixed versions, indicators, and response steps.
self-hosting
A practical comparison for homelab operators deciding whether to self-host WireGuard mesh VPN control plane or trust Tailscale's managed SaaS.
research
GhostLock is a Linux kernel use-after-free in futex priority inheritance. Patch and verification guidance for operators running containers, virtual machines, and CI jobs.
langflow
Langflow has THREE critical vulnerabilities actively exploited in the wild. With ~7,000 instances exposed on public internet and auto-login enabled by default, homelab operators are prime targets.
AI/LLM Generated
Executive Summary The threat landscape for self-hosted AI infrastructure has undergone a fundamental shift in 2026. What began as opportunistic compute theft — hijacking exposed LLM inference endpoints to resell API access at discounted rates — has matured into two convergent threats: (1) industrialized commercial supply chains that systematically scan, validate,
AI/LLM Generated
Local LLM Security Hardening: Threat Model for Self-Hosted AI Infrastructure For homelab and solo-operator AI rigs running consumer GPUs. No enterprise jargon. Just what to break, how it breaks, and how to fix it on hardware you actually own. TL;DR for the Impatient You are running a
AI/LLM Generated
The Ollama MLX Shift: What Homelab Operators Need to Know About Local AI Performance in 2026 TL;DR Ollama's switch to Apple MLX in version 0.19 (March 2026) isn't a platform replacement — it's an acceleration path for Apple Silicon with zero impact on
microsoft
Technical Advisory & Lab Note: SharePoint Server Deserialization RCEs, Machine-Key Theft, and Post-Exploitation Persistence 1. Executive Summary A coordinated threat-actor campaign is exploiting multiple critical vulnerabilities in Microsoft SharePoint Server on-premises to achieve unauthenticated or low-privilege remote code execution, deploy web shells, steal IIS ASP.
self-hosting
A data-driven analysis of 30 days of reverse proxy traffic reveals 1.16 million malicious requests — about one attack every 22 seconds. Here's what attackers actually want and how to defend against each family on a homelab budget.
AI/LLM Generated
A practical guide to applying least privilege, scoped identities, approval gates, and observability to MCP and tool-using AI workflows.