GitLab’s 10.0 RCE, UniFi Goes Matter-Aware, and an AI That Refused to Port a Game

Homelab Highlights for 2026-10-12: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

The Lead: GitLab Patches Critical Remote Code Execution Flaw

GitLab released emergency patches for a critical unauthenticated RCE vulnerability (CVE-2026-97229, CVSS 10.0) in the CI/CD regex compiler. Affects self-hosted Community and Enterprise Edition instances. Patched versions: 19.4.2, 19.3.4, 19.2.8.

Why it matters: A 10.0 CVSS bug that requires no login is the highest priority patch for anyone running a self-hosted GitLab reachable from the internet. GitLab often holds private repos and deployment credentials, making it a high-value target.

Source: docs.gitlab.com

News Roundup

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity flaw (CVE-2026-85097, CVSS 10.0) in the Bricksforge WordPress plugin is under active exploitation, allowing unauthenticated attackers to upload and execute arbitrary PHP code.

Why it matters: Active exploitation means this is not theoretical. Anyone running Bricksforge on a public-facing site should patch immediately.

Source: The Hacker News

Unifi Network 11 - Adds Matter / Thread Support

UniFi Network 11 introduces Matter and Thread device visibility, allowing users to see battery, firmware, and signal strength for smart home devices alongside IP devices in the topology view. Read-only for now.

Why it matters: For homelabbers with smart home gear, this brings Thread and Matter devices into the same network visibility as everything else, simplifying troubleshooting. Early access builds have broken Home Assistant integrations, so caution is advised.

Source: r/homeassistant - Homelab Highlights top (day)

Docker Engine 29.9.0 Fixes Five Security Vulnerabilities

Docker Engine 29.9.0 fixes five vulnerabilities, including four HTTP/2 flaws that could crash the daemon or cause excessive resource consumption. Also addresses a Windows-specific directory traversal issue.

Why it matters: Two security releases in two weeks means it’s a good time to check your Docker version. The HTTP/2 issues are primarily denial-of-service risks, but keeping the daemon updated is important for any exposed API.

Source: docs.docker.com

Withings is locking down their API for new accounts

Withings now requires a Withings+ subscription for new accounts (after October 12) to share health data via the free API plan. Existing accounts are grandfathered in.

Why it matters: This is a classic cloud-dependent device rug pull. It reinforces the value of local-first alternatives for health data, and existing users should be aware that grandfathering may not last forever.

Source: r/homeassistant - Homelab Highlights top (day)

Tool & Software Highlight: OpenNVR 0.1.6: self-hosted NVR where you can search footage in plain words

OpenNVR 0.1.6 is an open-source, fully offline NVR that runs AI on local hardware. New features include natural language search, detection apps (intrusion, loitering, line crossing, etc.), Home Assistant MQTT integration, and a redesigned dashboard.

Why it matters: Sentence-based search over locally processed footage is a game-changer for self-hosted camera setups. The project is transparent about its limits, and deployment is Docker-only, making it accessible for homelabbers.

Source: github.com

Community Highlight: I turned an old Redmi Note 9 Pro into a native Linux server: postmarketOS, Ethernet + PD, and a custom display dashboard

A community member documented converting an old Redmi Note 9 Pro into a native Linux server with postmarketOS, Gigabit Ethernet over USB-C with power delivery, and a custom dashboard using the phone’s display and sensors.

Why it matters: This project demonstrates the potential of repurposing old phone hardware as capable ARM servers, with detailed documentation on fixing USB-C PD and Ethernet issues. It’s a practical example of reducing e-waste while building useful homelab infrastructure.

Source: github.com

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

Host A: Straight into the serious one today. GitLab shipped an emergency patch release, and the headline flaw is a critical remote code execution bug that needs no authentication at all. It’s tracked as CVE-2026-97229 with a CVSS score of 10.0, which is the top of the scale. The technical cause is an integer overflow in the CI/CD regular expression compiler. Under certain conditions, an attacker can tuck a specially crafted regular expression into a CI/CD configuration file and get arbitrary code running on the GitLab server itself. No login required, which is exactly what makes internet-exposed instances the scary case. For anyone running a self-hosted GitLab reachable from the internet, this is the patch-now story of the day.

Host B: And for a homelab, GitLab is a particularly painful thing to get popped, because it tends to hold private repositories and deployment credentials. GitLab released patched versions across three branches: 19.4.2, 19.3.4, and 19.2.8, and the flaw affects both Community Edition and Enterprise Edition. The same security release also fixes a high-severity cross-site scripting issue and a flaw that let developers run pipelines on protected branches without proper authorization. Practical notes before hitting the upgrade button: these patches include database migrations, so a single-node install will have downtime during the update. Take a recent backup first and check the official upgrade path for the version in play. GitLab.com is already patched and Dedicated customers don’t need to do anything, so this one lands entirely on self-hosters.

Host A: One wrinkle worth knowing: version 19.3.4 has a known issue affecting merge request pages when the Ona integration is enabled, with a fix planned for 19.3.5. So anyone on the 19.3 branch running that integration gets to weigh waiting for 19.3.5 against patching now and living with broken pages. Either way, an unauthenticated 10.0 on an internet-facing GitLab is not something to sit on.

Host B: Next up, another maximum-severity bug, and this one is already being exploited. The Bricksforge plugin for WordPress has a flaw tracked as CVE-2026-85097, also a 10.0, and according to Patchstack it’s under active attack in the wild. The bug lets an unauthenticated attacker upload and execute arbitrary PHP on a vulnerable WordPress site, which is full remote code execution through a plugin. Anyone running Bricksforge should treat this as patch immediately, not patch this weekend, especially on a public-facing site.

Host A: Quick one from the network side now. UniFi Network 11 is out, and the interesting bit for smart-home people is Matter and Thread support. UniFi works alongside existing Matter controllers, so entering a Matter pairing code brings devices in for visibility into battery, firmware, and signal strength, and Thread devices finally show up in the topology view next to IP devices. [curious] Worth noting it’s visibility, not control, at least per the release notes, and one early tester reported the early-access build broke their Home Assistant integration badly enough that they rolled back. Early access being early access, maybe hold off on the production controller for a bit. The custom icons are apparently the sleeper hit of the release, if the community reaction is anything to go by.

Host A: Docker also shipped a security release in the same window: Engine 29.9.0 fixes five vulnerabilities, four of them in HTTP/2 handling in the daemon, where crafted requests could crash the daemon or burn excessive CPU and memory. The fixes mostly come from updating the Go runtime underneath, plus a Windows-specific issue involving directory creation outside Docker’s data root. The realistic risk for a home server is denial of service rather than someone walking into the containers, and it depends heavily on who can reach the Docker API. Between this and 29.8.2 at the end of September, that’s two security releases in under two weeks, so a version check is probably overdue.

Host B: Last one, and it’s a grumble. Withings is locking down its health data API. Accounts created after October 12th need a Withings+ subscription to share health data with free-plan apps, including integrations that already exist. Existing accounts are grandfathered in, which is the only reason current setups keep working. It’s the classic pattern of a cloud-dependent device getting tighter over time, and a fair nudge toward local-first alternatives for anything health-related going forward. One commenter’s take was that this is exactly why cloud-free solutions deserve a careful look whenever possible, and it’s hard to argue with that.

Host A: Time for the tool spotlight, aimed squarely at the self-hosted camera crowd. OpenNVR hit version 0.1.6 this week. It’s an AGPL-licensed, open-source NVR that runs its AI entirely on local hardware — no cloud account, works fully offline, so footage never leaves the network. The headline feature is search in plain language. Type something like red truck at the dock yesterday and it turns that into editable filters. Captions, colors, and vehicle types come from models running locally, and there’s an optional CLIP adapter for matching words to what’s actually in the frame, so searching for truck can find a lorry. It can also track where something went across multiple cameras.

Host B: Beyond search, the release rounds out the detection apps: intrusion with arming, loitering, line crossing, abandoned objects, package delivery, and gate control through GPIO, HTTP relays, Modbus, ONVIF, or MQTT, plus a smart doorbell mode with face enrolment. Home Assistant integration happens through MQTT discovery, so nothing gets installed in HA, access is scoped by an API token, and every command is audited. Deployment sounds refreshingly simple: Docker is the only requirement, and it scales from a Pi 5 handling recording and the basic apps up to a GPU box for the caption models and voice agent. The maintainer is upfront about the limits, which is refreshing: the native Home Assistant integration isn’t on HACS yet, and hardware accelerator support for things like Coral and Hailo is still thin. There are also security fixes in this release, so upgrading is the move for anyone already running it.

Host A: For anyone who has fought with rigid NVR search filters, sentence-based search over locally processed footage is a genuinely compelling pitch, and the honest limitations list makes the project easier to trust, not less.

Host B: Community story time, and this one is a fun reality check. A post on the ClaudeAI subreddit describes someone inspired by all the fan game ports showing up lately — decompiled games running natively on platforms they never shipped for. Curious to try it, they pointed Opus 5.5 at a folder with the files for Thief 3: Deadly Shadows, about two gigabytes, and asked it to decompile the game and run it on a new MacBook Pro. The model’s answer was basically no: it said the process takes years and it clearly can’t do that. On the facts, the model wasn’t wrong. Decompiling a full game is an enormous manual grind, and the ports people play take teams months or years. What stands out is the model refusing to fake its way through a workflow it can’t actually do, and instead showing the scale of the problem. That’s a better outcome than a confident hallucinated port plan.

Host A: Here’s where it gets interesting. The poster then pointed the model at a reverse engineering repo, and it downloaded Ghidra — a well-known open-source reverse engineering suite, for anyone who hasn’t crossed it — decompiled exactly one function in about a minute, and used it as a demonstration: look, this is what decompiled code looks like, the function name doesn’t make sense, and this would have to be done for thirty-two thousand functions. It even added that continuing would produce something that doesn’t compile, let alone execute. [thoughtful] Caveats apply, obviously. This is one person’s experience with one model on one game, not a benchmark, and nobody should take it as a verdict on what AI-assisted reverse engineering can ever do. For anyone curious, the practical read is to start with a tiny binary and see how far the tooling actually gets before promising anything big.

Host A: That’s Homelab Highlights for Monday. Until next time, happy hosting!