Shorter Certs, Patched-But-Not-Really AnyDesk, and a Backup Reality Check

Homelab Highlights for 2026-10-09: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

The Lead: Let’s Encrypt cuts certificate lifetimes to 64 days starting February 2027

Let’s Encrypt is reducing free SSL/TLS certificate lifetimes from 90 days to 64 days, effective February 10, 2027. An opt-in test window begins October 14, 2026.

Why it matters: For homelab operators, this change will be seamless for those already using modern ACME clients with ARI support, but anyone relying on hardcoded renewal schedules or manual processes needs to update their automation before the deadline to avoid unexpected certificate expirations.

Source: Ars Technica

News Roundup

Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access

A working exploit has been published for a pre-authentication remote code execution vulnerability in AnyDesk for Linux, granting root access before any connection approval. AnyDesk patched the flaw in version 8.0.3 in June but described it only as a crash bug with no CVE assigned.

Why it matters: The gap between the vendor’s minimal changelog and the severity of the flaw means many users may not have prioritized the update. Anyone running AnyDesk on Linux should verify they are on version 8.0.3 or later and treat internet-exposed remote access services as a priority.

Source: The Hacker News

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Threat actors are exploiting two recently disclosed vulnerabilities in the AhsayCBS backup utility to take over devices and deploy web shells and XMRig cryptocurrency miners, with the miner disguised as Microsoft Edge.

Why it matters: Backup servers are high-value targets because they often hold access to other systems. If AhsayCBS is in your stack, verifying patch status is critical.

Source: The Hacker News

A new feature for my blog, built using my voice

Simon Willison built a new Newsletters page for his blog almost entirely by voice, using the ChatGPT desktop app’s Codex tab in voice mode against a local development environment while cooking dinner.

Why it matters: This is a practical demonstration of voice-driven coding against a local dev environment, showing a real shipping workflow that goes beyond the gimmick stage. It’s worth a look for anyone curious about where AI-assisted development tooling is heading.

Source: Simon Willison’s Weblog

Tool & Software Highlight: Immich Keeps Getting Better, but Don’t Forget Your Backups

Immich 3.3.0 introduces shared people management, birthday memories, automatic stacking for edited photos, and improvements to thumbnails, OCR, and ML performance. The release also emphasizes that database backups do not include original media files, and a complete backup strategy requires both.

Why it matters: For anyone using Immich as primary photo storage, the new features are compelling, but the backup reminder is critical. Restoring a database without the media files leaves you with references to nothing. Following the 3-2-1 backup strategy and testing restores is essential.

Source: immich.app

Community Highlight: Radxa’s Q8B has 2x the performance and expansion of the Pi 5

Jeff Geerling reviews the Radxa Dragon Q8B, a single-board computer with a Snapdragon 8cx Gen 3 chip that on paper beats the Raspberry Pi 5. At $209 for 8 GB of RAM, it’s now priced similarly to the Pi 5, making it a compelling alternative for homelab use.

Why it matters: The Q8B offers a laptop-class ARM chip in a maker-friendly form factor at a competitive price. While software support and community ecosystem remain open questions, it’s a strong candidate for anyone priced out of the Pi market or looking for more performance in a small services node.

Source: Jeff Geerling

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

Host A: Big calendar item for anyone running TLS at home: Let’s Encrypt is cutting certificate lifetimes from 90 days down to 64, starting February 10, 2027. [with emphasis] And before anyone panics, there’s a test window — starting October 14, they’ll begin issuing the shorter certs to anyone who opts in, so there’s time to shake down your renewal setup before it’s mandatory.

Host B: That’s the whole point of the change, really. When Let’s Encrypt launched back in early 2016, certificates were commonly issued for one to three years, and the 90-day lifetime was deliberately aggressive — it forced the ecosystem to build renewal automation that basically didn’t exist before. Shorter validity also limits the damage when a private key gets stolen, because a leaked cert dies that much sooner. Sixty-four days is the next step in that same logic.

Host A: Here’s the practical read for a homelab, though. If the stack is already running a modern ACME client with ARI support — that’s ACME Renewal Information, where the client checks in with the CA about renewal timing instead of guessing — this should be genuinely seamless. The client adapts, certs rotate, nobody notices.

Host B: The people who should care are the ones with hardcoded renewal schedules or, worse, anything manual. If some cron job renews every sixty days on the dot, or a cert gets renewed by hand a couple of times a year, February 2027 is the deadline to fix that before things start expiring unexpectedly. [thoughtful] Worth checking which ACME client each box is running and whether it does ARI, rather than assuming. The opt-in test window starting on the 14th is exactly the right way to find out cheaply.

Host B: Some less fun security news to get through, and one thing that’s actually delightful. [skeptical] Starting with remote access: researchers have published a working exploit for a pre-authentication remote code execution flaw in AnyDesk on Linux. Pre-auth means before anyone approves the connection, and it hands over root access.

Host A: Here’s the part that stings. AnyDesk actually patched this in version 8.0.3 back in June, but the changelog described the fix only as fixing a bug that could lead to a crash. No CVE assigned, no security advisory. So anyone scanning changelogs for security relevance had no reason to treat that as urgent, and now there’s a public working exploit for root-level access. That’s a rough gap between what the fix was and what the vendor said it was.

Host B: For anyone running AnyDesk on a Linux box — and it’s a common remote-support tool in homelabs — the move is to confirm the installed version is at or past 8.0.3, and treat any internet-exposed remote access service as a priority anyway.

Host A: [quick aside] Next up, backup security. Attackers have been exploiting two recently disclosed flaws in AhsayCBS, a backup utility — specifically CVE-2026-105133 and another vulnerability — to take over affected devices and deploy web shells and XMRig cryptocurrency miners, with the miner disguised as Microsoft Edge. Backup servers getting popped is a special kind of bad, since those boxes often hold the keys to everything else. If AhsayCBS is in the stack, patch status is worth verifying today.

Host B: And to lighten the mood, a workflow note. Simon Willison shipped a new feature on his blog — a Newsletters page indexing all his newsletters. The notable part is how he built it: almost entirely by voice, chatting to his laptop via the ChatGPT desktop app’s Codex tab in voice mode, running against a local development checkout. While cooking dinner, apparently.

Host A: That’s a genuinely interesting workflow data point. [curious] Voice-driven coding against a local dev environment sounds gimmicky until someone with real shipping habits demonstrates it end to end. Whether it generalizes beyond a solo blog codebase is an open question, but as a demonstration of where the tooling is heading, it’s worth a look.

Host A: Immich shipped version 3.3.0 on October 7, and this release leans hard into sharing and organization. [with emphasis] The headline feature is shared people management: users in the same cluster group can now share recognized people across their libraries, so a family running Immich together stops maintaining three separate entries for the same kid. There are also birthday memories that surface photos from previous birthdays, and automatic stacking so an edited photo from a phone groups with its original instead of cluttering the timeline. Thumbnail quality, OCR models, and machine learning performance all got attention too.

Host B: The shared-people feature is the one that will actually change day-to-day behavior for family instances, since face recognition data has always been per-user, which meant duplicated effort and inconsistent tagging. But the release post spends real time on something less shiny: backups. Immich includes automatic database backups, which sounds reassuring until the documentation detail lands — those database backups do not contain the original photos or videos. The media lives separately in the configured upload location, so restoring the database alone after a drive failure leaves records pointing at files that no longer exist.

Host A: So the complete picture is both copies — the media files and the database — and they need to be consistent with each other. Restoring a database from one point in time alongside photos from another leaves references to missing files. [thoughtful] Immich recommends the 3-2-1 approach, three copies on two media types with one off-site, and backing up the entire upload location where practical. The docs also suggest following their recommended backup order and actually testing a restore. And a backup drive permanently attached to the same machine shares some failure modes with the primary, which is the argument for the off-site copy. For anyone treating Immich as primary photo storage, that’s the checklist worth walking this weekend.

Host B: Jeff Geerling got his hands on the Radxa Dragon Q8B, a single-board computer that, according to his review, on paper beats the Raspberry Pi 5 in pretty much every way. [conversational] And the interesting part is the price context. The Q8B runs $209 for 8 gigs of RAM, which used to be an easy pass for a board like this. But with the 8-gig Pi 5 now selling for almost the same amount at the time of the review, the math has changed enough that he figured it was worth a shot.

Host A: The engine behind the paper numbers is a Snapdragon 8cx Gen 3 chip — the same silicon he tested years ago in Microsoft’s Windows Dev Kit 2023. That’s an ARM laptop-class chip showing up on a board with expansion aimed at the maker and homelab crowd, which is a genuinely different proposition from the Pi’s long-standing ecosystem.

Host B: The honest caveat, and Geerling’s history of board reviews makes this worth waiting on: paper performance and real-world experience are different animals. Software support, community, and peripheral compatibility are where the Pi has always earned its keep, and a faster chip doesn’t answer those questions. For a homelab use case — a beefy little services node, a media box, a build server — the appeal is obvious. Whether the software story holds up is what the full testing will tell. [lighter] Worth keeping an eye on, especially for anyone who’s been priced out of the Pi market lately and is shopping for alternatives.

Host A: That’s Homelab Highlights for Friday. Until next time, happy hosting!