Container Escape, AWS at Home, and Audio Enhancements

Homelab Highlights for 2026-09-23: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

The Lead: Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape

A use-after-free in the Linux kernel’s AF_UNIX socket subsystem can be used to escape a container and gain root on the host. The upstream fix landed August 6, but Ubuntu has not shipped patches for its 26.04, 24.04, or 22.04 LTS releases.

Why it matters: Any containerized service on those Ubuntu LTS versions could be an escape route to host root, especially on systems facing untrusted networks.

Source: The Hacker News

News Roundup

MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key

Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of internet-exposed routers without a password or SSH key. MikroTik released a fix in version 7.17.

Why it matters: If you use MikroTik as your edge router and have SSH exposed, this chain means an attacker can own your network without any credentials.

Source: The Hacker News

Plex Announcement - Audio Enhancements: Boost Dialog & Normalize Loudness

Plex announced two new audio features for Plex Pass subscribers: Boost Dialog to make quiet conversations clearer, and Normalize Loudness to keep volume consistent. Both require a Plex Pass on the user’s account, not just the server admin’s.

Why it matters: A welcome quality-of-life update for Plex users, but the per-user subscription requirement may limit adoption on shared servers.

Source: r/PleX

HA-arr-stack-card — some cool new stuff for your ARR stack

A major update to the HA-arr-stack-card for Home Assistant adds Lidarr support, similarity search, Last.fm integration, and a performance refactor that only loads JavaScript for features you use.

Why it matters: This card lets you manage your entire ARR stack from Home Assistant, and the refactor improves performance on slower devices.

Source: github.com

I filed 639 of my own photos by date. The camera date was missing or unusable for almost a quarter of them.

A datahoarder tested a Windows tool called Filewright on 639 personal photos and found 23.8% had no usable EXIF or filename date. The tool uses a small local AI model as a last resort, with clear labels so guesses aren’t mistaken for facts.

Why it matters: A practical look at the real-world challenge of organizing photo libraries, with an offline tool that handles edge cases transparently.

Source: apps.microsoft.com

Tool & Software Highlight: Open-source AWS-compatible cloud for your own hardware — EC2, S3, VPC, EKS, RDS on a single box

Spinifex reimplements the AWS API on your own hardware using real QEMU VMs and OVN networks. It installs as a single-node cluster from USB or ISO, and you can add more nodes later. IAM compatibility is a work in progress, but it supports EC2, S3, VPC, EKS, RDS, and GPU passthrough.

Why it matters: For homelab users with AWS skills, this lets you run the same Terraform and tools on your own hardware without cloud bills, though IAM gaps may trip up some workflows.

Source: r/selfhosted

Community Highlight: Finally moved off claude code to OSS models on opencode

A developer moved their coding workflow from Claude Code to open-source models like Kimi K3, GLM 5.3 Flash, and DeepSeek V4.1 Flash, using a service called Opencode. They found model capability alone wasn’t worth the platform restrictions anymore.

Why it matters: Shows the growing viability of OSS models for complex development tasks, and a real-world decision to switch based on capability and platform freedom.

Source: r/ChatGPTCoding

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

Host A: DepthFirst security researchers have dropped an exploit for a Linux kernel bug that’s a container’s worst nightmare. [with emphasis] It’s a use-after-free in the AF_UNIX socket subsystem, tracked as CVE-2026-80521, and it can let a container escape to get root on the host.

Host B: The upstream kernel fix landed on August 6th, but according to the article, Ubuntu hasn’t shipped patches for its 26.04, 24.04, or 22.04 LTS releases yet. That’s a pretty wide-open window.

Host A: For a homelab, that means any containerized service—Docker, LXC, systemd-nspawn—could be a potential escape route if someone finds a way to trigger the bug. The exploit doesn’t need special container privileges to start, and if it works, it hands over the host root keys.

Host B: The practical takeaway is to check if you’re running those Ubuntu LTS versions with containers, especially on anything facing untrusted networks. The article doesn’t mention workarounds, so the main move is waiting for Canonical’s patches or, if it’s an option, considering a kernel from another source. It’s a solid reminder to watch your distro’s security advisories closely.

Host B: Next up, a nasty one for network gear. The Hacker News reports a vulnerability chain in MikroTik RouterOS that CERT Polska is calling MikroTrick. It combines an SSH state-machine flaw with an argument-injection bug, letting attackers take full admin control of internet-exposed routers without a password or SSH key.

Host A: That’s a bad day for anyone using MikroTik as their edge. MikroTik released a fix in version 7.17, so if you’re on an older version and have SSH open to the world, it’s definitely patching time. [thoughtful]

Host B: [lighter] On a completely different note, Plex announced two new audio features for Plex Pass subscribers. Boost Dialog tries to isolate dialogue frequencies to make quiet conversations clearer, and Normalize Loudness aims to keep overall volume levels consistent using the EBU R128 standard.

Host A: A welcome quality-of-life update for sure, especially if you’re tired of riding the remote. The catch, noted in the announcement, is that both features require a Plex Pass on the user’s account, not just the server admin’s. So if you share your server, your users need their own subscriptions to get the benefits.

Host B: Shifting to a community project, a developer posted a major update to the HA-arr-stack-card for Home Assistant. This card lets you manage the whole ARR stack—Radarr, Sonarr, and now Lidarr—right from the HA interface. The new version adds Lidarr support with calendars, a similarity search for finding related media, and Last.fm integration for music recommendations.

Host A: They also did a significant refactor so the card only loads the JavaScript for the features you actually use, which should help performance on slower phones and tablets. The developer mentions using AI to speed up development but is clear about reviewing and refactoring the code to avoid an unmaintainable mess.

Host B: And finally, a datahoarder shared their experience with a Windows tool called Filewright that organizes photos by date. They ran it on 639 personal photos and found nearly a quarter—23.8 percent—had no usable EXIF or filename date. The tool uses a small local AI model as a last resort to guess dates from file timestamps, with clear labels so guesses aren’t mistaken for facts. Everything runs offline, which is a nice touch.

Host A: For a deeper tool dive, let’s look at Spinifex. [thoughtful] It’s an open-source project from Mulga that reimplements the AWS API on your own hardware—EC2, S3, VPC, IAM, EKS, RDS, the whole suite. But it runs actual QEMU VMs and OVN networks, not just an API mock like LocalStack.

Host B: The pitch is pretty compelling for homelabs. If your day job involves AWS, or you’re studying for a certification, you can point your existing Terraform, CLI, and SDKs at your own rack instead of a cloud bill. The project’s engineers say it installs as a single-node cluster from a USB or ISO, and you can add more nodes later.

Host A: They’re upfront about what’s not fully baked yet. IAM compatibility is a work in progress—they implement 76 of the APIs, but policy versions and some condition operators aren’t there, which can trip up Terraform. The policy engine rejects anything it can’t enforce, so you won’t have silent security gaps. Under the hood, it uses NATS for the control plane, OVN for networking, and a custom object store for S3 and EBS, with data sharded across nodes. They mention GPU passthrough works for both EC2 and ECS, and they have Bedrock-compatible inference on the roadmap. For anyone who’s fought with OpenStack’s complexity but wants real cloud semantics, this looks like a fascinating alternative.

Host B: Wrapping up with a community highlight from the coding world. A developer posted about finally moving their development workflow off Claude Code and onto open-source models. [conversational]

Host A: The post says Claude Code, and Opus specifically, had been the default because it could handle not just tasks but also a lot of the surrounding cognitive load to make things work as expected.

Host B: But with newer OSS models like Kimi K3, GLM 5.3 Flash, and DeepSeek V4.1 Flash becoming available, the developer’s take was that model capability alone wasn’t worth putting up with the platform’s restrictions anymore. So they moved fully to using a service called Opencode for their coding assistance.

Host A: That’s Homelab Highlights for Wednesday. Until next time, happy hosting!