Heads up to anyone hosting applications based on PHP that a pair of vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are receiving emergency patches on 2026-10-21 at 14:00 UTC. Both have CVSSv4 scores of 9.2 and are rumored to affect all versions of PHP.

More details are available here: https://cert.europa.eu/publications/security-advisories/2026-018/

CERT-EU strongly recommends identifying PHP-based applications and preparing to patch as soon as fixed versions become available. Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.

Needed another year or three 😭

16 unrecoverable sectors. Still reads healthy on a simple smart scan but I run an extended each month.

For this reason, unfortunately.

RIP

Eight SSL Intermediate Certificates of eMudhra have been publicly leaked. All your servers https traffic can be broken right now. Browsers are fine as they have revoked the certificates but as you can see, curl and many other libraries still accept those.

Proof of concept and check if you are affected: ``` curl https://q3k.google.com --resolve 'q3k.google.com:443:135.181.235.221'

q3k.google.com

oh, this is bad

No download can be trusted right now. Remember to not only patch your main systems but every docker container you run.

Edit: The intermediate certificates where not really leaked, rather the CA used only 8 bit of randomness. One of the keys was literally "4". Check the comment here to learn more: https://www.reddit.com/r/linux/comments/1xau81w/comment/19re642t0zxa8/?utm_source=fucktracking Here is a list of the keys: https://mastodon.catgirl.cloud/@49016/117474217042191790

I just wanted to let you know, both Immich and Paperless-ngx (two of my most favorite selfhosted apps) are now at version v3.3.3.

(I know, I have too much time on my hand)

OpenMW-Web is OpenMW (the open-source Morrowind engine) running entirely in a browser tab. Players install nothing. The part I think this sub will care about is the server, which I've spent the last couple of months building an admin dashboard for.

Getting it running is one command if you have Docker:

`git clone https://github.com/Virtastic/openmw-web.git && cd openmw-web && ./setup.sh` (Windows: `.\setup.ps1`)

It pulls prebuilt images from GHCR, so nothing compiles on your box, and opens the setup wizard at localhost/admin. The wizard asks for an admin account, single player or multiplayer, how people sign in (passwords, Google, Discord, Microsoft or invite codes), where storage lives (local disk or any S3-compatible bucket) and how the server is reached. Give it a domain and Caddy sorts out HTTPS on its own. It also walks you through adding your game files.

After that it's all the dashboard: who's online and where, every account with its characters and saves, CPU, memory, network and disk, kicks, bans and reports, logs and an audit trail of what admins did. Mods upload as .zip or .7z with a drag-to-order load order and conflict warnings, and Tamriel Rebuilt has its own setup step. Updates are a button, and rolling back is one line in .env. No config files to hand-edit.

Multiplayer has also moved out of the experimental flag and into alpha: one shared world simulated on the server, so everyone sees the same NPCs and fights. The last few releases fixed a lot (teleporting enemies, rubber-banding, restarts kicking people), and 1.6.2 stops new areas freezing while they load.

It's alpha, so there are bugs. If you want to help:

- Play on our community test server (UAT): https://morrowind.virtastic.app

- Grab an invite code in the Discord, and tell us what breaks: https://discord.gg/PzFfDkbSue

- Source, docs and changelog: https://github.com/Virtastic/openmw-web

Feel free to check out our other projects like this too: https://github.com/Virtastic

There have been a few reports of old Plex servers getting popped by Plex2Shell in the last few days (miner + proxy). Mine got hit too, but it dropped a DDoS bot instead.

Internet kept dropping Sunday night/Monday morning. Plex was being told to flood other people and maxed out our upload every time. Our upload is pretty poor, so it was obvious. With better upload you may not notice at all.

I was on 1.43.0. I run staged updates, get ntfy alerts for new images, and Plex was deliberately held. In May 1.43.1 broke direct play on our Samsung Frame, Plex acknowledged the bug, so I pinned VERSION= to the last good build with a weekly reminder to retest. The reminder only checked whether the Samsung bug was fixed. It never flagged that 1.43.3 was a security fix, so the hold kept me on a vulnerable version.

If you hold back any app for a bug, make sure security releases still get your attention.

FYI:
- in from 94.154.43.88 on 32400, then called back to it on 8952
- /tmp/.pxb (its own curl/wget), /tmp/.px_7c1e
- bot at /tmp/.spid (self-deletes, shows as "cron"), copy at /var/tmp/kworker + kworker.sh
- C2 176.65.149.82:48101, backup hand.genddos.st
- plain text orders like `!ATK 179 udpplain 80 53 len=1400`
- sha256 a654ffc9ea1d3af1cb07feeefe8ee078a0faaaf60b31aa20cfbe082d6c22696c

Look for a Plex child process called "cron", junk in /tmp or /var/tmp in the container, or TranscoderH264Options in Preferences.xml that's present but empty. The hunt script at github.com/code-zm/plex2shell is worth running.

Fixed with 1.43.4, a container rebuild and blocking the IPs. Change your Plex password too, it steals the owner token.

(Mods, could we get a "Security" flair?)

Doska is a kanban board web and desktop app that supports offline file storage (folders with .md files) or self-hosting a sync server. When there’s a sync server, collaboration features are also supported.

The self-hosted setup includes versioned Docker containers for the web server and the sync server.

It looks good on mobile (PWA), and I’ve put a lot of work into making it fast, responsive and pleasant to use.

There’s no login gate or any other kind of gate: it’s fully MIT open source.

GitHub: https://github.com/romenkova/doska
Live demo (no signup): https://app.doska.sh/d/welcome?skip_onboarding=true

Features

• Offline-first, local-first
• Markdown editor: syntax highlighting, tasks with a counter, slash menu
• Server to sync boards across devices
• Accounts: members, shared boards, public boards
• Local folder sync: boards and columns as folders, cards as Markdown files
• Attachments: files, images
• SSO: OIDC-compatible auth providers
• Deadlines, priorities and sorting for cards on the board
• MCP server
• Cross-board deadlines view
• Quick note window: always on top, opened with a keyboard shortcut
• Tags
• Assign users to cards
• Activity history view

Hey everyone!

Exactly one year ago, I posted my project here when it was still called AltSendme. It was a small, early-stage project with around 50 GitHub stars. The support and encouragement I received from this community genuinely motivated me to keep building it.

Since then, the project has grown to almost 10,000 GitHub stars, and I've renamed it DashBeam. It's been quite a journey, and I wanted to come back and share what's changed.

DashBeam is a free, open-source, peer-to-peer file transfer application built on Iroh. The idea is simple: transfer files between your devices without uploading them to a cloud storage service first.

A few things I've added since my original post:

• Android app: DashBeam is now available on the Google Play Store, so you can transfer files between your phone and other devices.
• Self-hosted relay infrastructure: You can run your own Iroh relay on a VPS using Docker Compose or flydotio, configure it in DashBeam, and even enable access controls. Self-hosting guide
• Nearby device discovery and pairing: Discover and pair devices on your local network for a more seamless transfer experience.
• Web app: Don't want to download or install anything? You can use DashBeam directly in your browser.
• Portable versions: Prefer not to install software? Portable builds are available for supported desktop platforms, too.

For some real-world numbers, we've tested transfers of up to 452 GB in a single transfer, with peak speeds reaching 125 MB/s under suitable network conditions.

The project is still fully open source under AGPL-3.0, and it doesn't require accounts or include usage tracking or ads.

GitHub: https://github.com/tonyantony300/dashbeam

I'm still actively developing it, and there's plenty left to improve. If you remember the original AltSendme post, thank you for being part of the journey. And if you're discovering it for the first time, I'd genuinely love to hear what you think, especially from people running their own infrastructure.

Thanks!

Overleaf subscriptions can be expensive, especially for research teams. For institutions and labs that need a privately hosted online LaTeX editor, Overleaf Community Edition is a useful starting point, but it leaves out many features those teams rely on.

That’s why we built Ayakaleaf Pro(https://github.com/ayaka-notes/ayakaleaf-pro). We’ve extended the Community Edition with nearly all Pro features and additional integrations, bringing a more complete collaborative writing environment to your own infrastructure—free and open source.

Features include:

- Two-way GitHub sync, including GitHub Enterprise.
- Two-way GitLab sync, including self-hosted GitLab, currently in early preview.
- Two-way Dropbox sync, currently in early preview.
- Git access to clone, pull, and push your projects.
- AI chat assistant for editing LaTeX and fixing problems.
- Compile-error assistant to explain errors and suggest fixes.
- A per-project MCP server that lets AI agents edit, compile, and comment.
- Python script runner within your projects.
- Zotero and Mendeley integration with OAuth.
- Advanced reference search.
- Track changes and full project history, with restore and download.
- Pandoc import/export for Word, Markdown, and LaTeX.
- Template gallery and math symbol palette.
- SSO through LDAP, SAML, and OAuth.
- Admin panel for managing users and projects.
- Sandboxed compilation with selectable TeX Live images.
- Configurable compilation time limits.
- Optional self-registration with email-domain restrictions.
- Support for both x86_64 and ARM.

The source code is available on GitHub, along with a Playground that lets you try Ayakaleaf through GitHub

Codespaces:

https://github.com/ayaka-notes/ayakaleaf-pro

We also maintain a dedicated documentation site with installation instructions, configuration guides, integration setup, and upgrade notes:

https://ayakaleaf-pro.ayaka.space

If you’re running Overleaf for your lab or institution, we’d love to hear about your setup and what you’d like to see next. Feedback, bug reports, and contributions are welcome!

Some of Ayakaleaf’s features build on work from Overleaf CEP, another community project worth checking out. Both projects extend Overleaf’s self-hosted capabilities, and we’re grateful to the CEP contributors for their work. We’re all helping make the Overleaf ecosystem better for the community.

I feel like there’s a point where adding more services stops being fun and just becomes another thing to maintain.
Lately I’ve been leaning toward keeping things simple. Fewer moving parts, less troubleshooting, and ideally stuff that just works without me checking on it every other day.
Anyone else gone through a phase of simplifying their setup after spending years adding more to it?