Self-hosted bulletin for Thursday morning, Oct 22
Big news and drama
- Several unpatched Linux kernel vulnerabilities were accidentally posted to the public kernel mailing list. Trend Micro’s ZDI sent the reports to LKML instead of the private security list. They include two CVSS 9.0 remote code execution bugs in SMB Direct and ksmbd (the kernel’s built-in SMB file server), so anyone exposing ksmbd should watch for patches. Phoronix · HN discussion
- The person who leaked the PHP RCE news early apologised on HN. Separately, Amazon says PHP2Shell was already being exploited on Oct 17, before public disclosure. The poster says they’d been told there was no embargo. Docker has also published patched and hardened PHP images. Tell HN apology · AWS threat intel post · r/docker post
- In a Railway follow-up, attackers reportedly drained about $371,000 from more than 200 crypto wallets using the stolen secrets. Railway is restoring deployments in stages from Oct 22 and contacting affected users directly. X story
- The first software-only Nintendo Switch 2 jailbreak is out. It’s called ns2jb and uses a SmileBASIC 4 integer overflow on firmware 23.0.1 to run homebrew in userland. It’s tethered and isn’t full custom firmware. Write-up · HN discussion
New or trending projects
- OpenAI’s official command-line tool for its API is trending on HN. It’s Apache 2.0 licensed and has about 940 GitHub stars. openai-cli · HN discussion
- A researcher rooted a 2025 Samsung smart TV and plans open-source firmware that strips out the tracking. They found heavy telemetry and screen captures used for ads, and suggest owners turn off auto-updates for now. X story
- A new terminal tool colours every listening port by who can actually reach it. It sorts ports into loopback only, one interface, or the whole network, which is handy for auditing a homelab box. r/homelab post
Notable releases
- n8n shipped 2.44.6 (stable), 1.123.86, and 2.45.2 as a beta, and CrowdSec put out v1.8.2-rc2 for testers. The n8n 2.44.6 fix stops the Postgres node from overwriting global pg types. n8n 2.44.6 · n8n 1.123.86 · CrowdSec v1.8.2-rc2
Community discussions
- “A Markdown File Should Just Open” argues that plain .md files deserve a default viewer on every OS. It drew more than 60 comments. Post · HN discussion
- “I can’t believe PowerShell is good” sparked a 70-comment shell debate. Post · HN discussion
- “Cloudflare is rewriting everything in Rust” traces the move back to the 2017 Cloudbleed memory leak. Post · HN discussion
- A r/homelab post warns that “CWWK.net” isn’t the real CWWK and offers no manufacturer support. That’s worth knowing if you buy their popular mini PCs and firewall boxes. r/homelab post
Security quick hits
- Node.js 22.23.4, 24.22.1 and 26.12.1 fix ten vulnerabilities, including a critical Brotli decoder out-of-bounds write (CVE-2026-111497). It affects apps that decompress untrusted data, so update any self-hosted Node services. X story
- musl libc has multiple integer overflows in regcomp (CVE-2026-107891). This matters for Alpine-based containers, so watch for updated base images. r/linux post