Dokploy v0.31.0 password change yields host RCE via backtick
A member changing a database password can reach host command execution; the researcher live-tested the official v0.31.0 image.
Stories per day · 30 days
2 RSS
Relatedair-gapped1business-continuity1command-injection1critical-infrastructure1dead-mans-switch1devops1docker1dokploy1gitlab1integer-overflow1mcp1media-server1pentest1php1rce1remote-code-execution1reporting1sekoia1
21 stories, newest first · one card per story
Stories tagged #self-hosted
PentestPad pitches self-hosted AI so client findings stay in-house
The reporting platform can run air-gapped, point its assistant at a local model, and expose findings over MCP.
Sekoia offers a self-hosted SOC platform for restricted environments
The vendor says customers control data location, connectivity, AI deployment and where human approval is required.
GitLab patches max-severity regex compiler RCE (CVE-2026-110264)
An unauthenticated integer overflow can run arbitrary code; GitLab.com is already on the patched release.
14
Death Plan Switch is a self-hosted dead man's switch for solo developers
The free MIT-licensed PHP app emails weekly, then alerts next of kin and other contacts if check-ins stop.
Talorys – A self-hosted personal AI agent on Cloudflare's free tier
Talorys is a self-hosted personal AI agent that runs on Cloudflare's free tier.
CVE-2026-21589: Critical Atlassian File Access
Atlassian disclosed CVE-2026-21589, a critical unauthenticated file-access flaw in eight self-hosted products.
Self-hosted HTTP tunnels with SSH and Nginx
A write-up shows self-hosted HTTP tunnels using OpenSSH reverse forwards and nginx signed URLs.
CVE-2026-90970: Critical GitLab AI Gateway Flaw Fixed
GitLab patched CVE-2026-90970, letting authenticated Duo users execute commands on self-hosted AI Gateways.
3
IBM Brings Bob to Self-Hosted and Air-Gapped Environments: Agentic Software Development Without Moving Your Code
IBM made agentic coding platform Bob generally available for on-premises, sovereign-cloud, and air-gapped deployments.
Critical GitLab AI Gateway Flaw Lets Attackers Execute Arbitrary Commands
GitLab patched CVE-2026-90970, a CVSS 9.9 bug letting authenticated users execute commands on self-hosted AI Gateway.
4
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers
GitLab patched CVE-2026-90970, a CVSS 9.9 command-execution flaw in self-hosted AI Gateway.
4
Gitea 28.0
Gitea 28.0 adds audit logs and bot accounts, withholding security-fix details for about a week.
An OpenAI Agent Hacked Australia's Health Service. Their Government Found Out Months Later.
SolarWinds has patched two RCE vulnerabilities in Observability Self-Hosted, affecting all versions up to 2026.2.3.
2
SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted 2026.2.3; CVE-2026-28324 scores CVSS 9.8, CVE-2026-28325 scores 8.8, no exploitation reported.
2
OpenClaw Releases 2026.9.5 With Atomic Updates, Plugin Hot Reload, Conversation Sharing, and Expanded GPT Live
Open-source personal AI agent OpenClaw released 2026.9.5, adding atomic updates with rollback, plugin hot reload, and conversation sharing.
3
Forgejo 16.0.4 has a critical security bug fix (RCE - Remote Code Execution)
Forgejo 16.0.4 fixes a critical remote code execution vulnerability in the self-hosted Git forge; administrators should update promptly.
Show HN: Self-hosted company OS, Claude Code and Codex agents in departments
OtoDock, a self-hosted company OS that organizes Claude Code and Codex AI agents into departments, was launched on GitHub via Show HN.
CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0)
CVE-2026-37171: SuperTokens Core 6.0.0-11.4.0 lacks tenant separation in session operations, enabling cross-tenant access.
Emerging Threat: (CVE-2026-60004) Gitea Remote Code Execution via ...
CVE-2026-60004 (CVSS 9.8) lets attackers with repository write access achieve RCE on self-hosted Gitea servers via malicious git hooks; fixed in 1.27.1.
15
Over 8,300 Gitea servers vulnerable to code execution attacks
Over 8,300 internet-facing Gitea servers are exposed to active exploitation of CVE-2026-60004, an authenticated code injection flaw enabling arbitrary code execution.
5