Detection rule development, Sigma rules, YARA signatures, SIEM integration, and security monitoring.
AI/LLM Generated
Access date: 2026-10-19 Format: Evergreen deep-dive (durable synthesis, evidence-first) Status: Publication-ready draft Pillar: Self-hosted infrastructure security What this is A pattern synthesis. It names a recurring 2026 pattern in self-hosted software, explains the shared structural root causes across seven named incidents, argues why
Threat Intel
This note maps three runc container-escape CVEs disclosed together on November 5, 2025: the maskedPaths symlink bypass, the /dev/console mount race, and the LSM label write redirect. Chained they reach host root; patched individually they leave gaps for homelab distros.
Threat Intel
A second shadow-MMU escape in a month: Zapscape (CVE-2026-64561) lets a nested guest reach host root on an unpatched KVM. If you rebooted for Januscape, check the booted kernel again — separate bug, separate fix.
self-hosting
Five agencies published a joint PLC advisory. Its reconnaissance playbook works against a homelab with a public IP just as well as a PLC rack. A first-person external audit of the Malwlab surface: enumeration checklist, before/after delta, and controls left behind to catch anyone scanning back.
cve-2026-59310
A five-day exploitation window, a reverse SSH backdoor, and a patch that closes the front door while the channel stays open. The vCenter triage.
homelab
CISA added four self-hosted apps to KEV in three weeks: Metabase, MLflow, Zimbra, Gitea. The 72-hour operator checklist: exposure check, patch or compensate, compromise check, scoped credential rotation, documentation for the next incident.
Threat Intel
Zimbra 10.1.x below 10.1.20 with the optional zimbra-snmp package and snmp_notify enabled is directly exploitable - CERT Polska confirms an ongoing in-the-wild campaign, the CISA KEV remediation due date has passed, and the observed persistence is JSP web shells in Jetty webapps.
research
Hands-on checklist for homelab operators: detect, fingerprint, and harden exposed MCP endpoints running on Ollama, Claude Code agents, or custom self-hosted AI services. Based on Trend Micro research documenting ~1,500 unauthenticated servers in 2026.
AI/LLM Generated
A practical guide to applying least privilege, scoped identities, approval gates, and observability to MCP and tool-using AI workflows.
AI/LLM Generated
GreyNoise honeypot data reveals 300,000+ Ollama instances exposed to the internet. Bleeding Llama (CVE-2026-7482), LLMjacking campaigns, and agentic weaponization represent an escalating threat to homelab AI deployments.
Malware Analysis
Executive Summary: Operation Cronos Failed to Kill It Operation Cronos was supposed to end LockBit. In February 2024, the FBI, UK's NCA, Europol, and agencies from eight other countries took down the group's infrastructure, seized its source code, arrested its ringleader Dmitry Khoroshev's alleged