Category
Security & Monitoring
96 articles
OpenSSH 10.6p2: password bypass on Alpine
OpenSSH 10.6p2 fixes a password authentication bypass on Alpine and musl: check your exposure, update the package, restart sshd and look for traces in your logs.
PolyShell CVE-2026-48356: check and fix your Magento stores
PolyShell (CVE-2026-48356) is in the KEV catalog: find Magento stores missing the APSB26-73 fix, update them, then hunt for webshells and injected JavaScript.
PHP: fix CVE-2026-91767 and CVE-2026-91769 (OpenSSL)
Two moderate PHP flaws affect TLS host name verification. Fixed versions per branch, commands for Debian, RHEL, cPanel and Docker, and what to do on end-of-life branches.
Ubuntu 22.04 end of support: move to 24.04 (VPS, cPanel)
Ubuntu 22.04 leaves standard security support in May-June 2027. In-place upgrade or new server, ELevate for cPanel, backup and rollback plan.
Magento 2.4.6 out of support: upgrade to 2.4.9, short cutover
Standard support for Magento 2.4.6 has ended. Adobe's dates, the server stack 2.4.9 needs, and a Composer upgrade rehearsed in staging, with downtime cut to the switch.
Drupal Commerce CVE-2026-118539: patch and audit orders
Commerce Core flaw under exploitation, advisory SA-CONTRIB-2026-254: find affected versions, move to 3.3.13 or 8.x-2.41, then audit your orders.
eMudhra: check the trust store on your servers
Eight eMudhra intermediate CAs were compromised: audit ca-certificates, curl, Python, Node, Java and containers with commands, and see what still awaits a fix.
WordPress 7.1.4: update your fleet and close wp-content/upgrade/
WordPress 7.1.4 fixes 22 flaws, including an upgrade race condition. WP-CLI inventory, branch table, nginx and Apache rules for agencies.
Cloudflare for a client site: SSL Full (strict) and cache
Put a client's site behind Cloudflare without redirect loops or private pages in cache: Full (strict) mode, cache rules and the checks to run.
VPS snapshot vs backup: what differs and how restore works
VPS snapshot or backup: what each one protects, what it does not, how restoring works, and a decision rule for the VPS you run for your clients.
Hacked client WordPress site: an agency recovery procedure
Isolate without destroying evidence, choose between cleaning, restoring or rebuilding, reopen with renewed access and inform the client. wp-cli commands included.
Monitoring client site uptime: the monthly report
Probes, checks before alerting, maintenance windows and a monthly report: how an agency monitors client sites without drowning in false positives.
SSL renewal failed: diagnose before you retry
Certificate expired despite automatic renewal? DNS, redirects, firewall, CAA, CDN proxy: the diagnostic tree and the commands to fix the cause.
Plex2Shell (CVE-2026-96652): fix Plex on your VPS
Plex2Shell chains CVE-2026-96652 to -96656 in Plex Media Server. Check your version, close port 32400, hunt for an earlier intrusion: tested commands.
UpdraftCentral: stolen keys, fake plugins, a clean restore
Stolen UpdraftCentral keys led to fake plugins on WordPress sites: revoke the keys, audit plugins and admin accounts, then restore from a clean backup.
CVE-2026-98432: check your VPS kernel with no fix yet
Use-after-free in the Linux kernel's IPv4 TCP stack: status published by Ubuntu and Red Hat on 30 October 2026, check commands, and what to do without a fix.
Enable DNSSEC on a client's domain without an orphan DS
Enable DNSSEC in the right order: sign the zone, publish the DS at the registrar, verify with dig and delv, and change DNS provider without an orphan DS.
Bricksforge CVE-2026-85097: update and audit your WordPress fleet
Bricksforge 3.1.8.10 fixes CVE-2026-85097, an exploited unauthenticated upload. wp-cli inventory, dropped PHP files, access logs, secrets to rotate.
Fragnesia CVE-2026-46300: patch the Linux kernel (PHP2Shell)
Fragnesia (CVE-2026-46300), chained with PHP2Shell, leads to root. Fixed kernels by distribution, esp4/esp6/rxrpc workaround, checks and traces.
Testing a client backup restore: an agency procedure
A quarterly procedure to restore a client site on a disposable VPS, measure the actual RTO and RPO, and hand the client a dated restore test log.
Monthly client VPS security audit: a 45-minute checklist
Seven checks to run every month on a client VPS: updates, kernel, SSH accounts, ports, certificates, backups, logs. Includes a dated one-page report.
GitLab CVE-2026-110264: update your self-managed instance
GitLab CVE-2026-110264 (CVSS 10.0): fixed version per branch, backup, Omnibus or Docker upgrade, then a check for traces of compromise.
PwnEscape and Vghost: update the Linux kernel on your VPS
Two Linux kernel flaws from October 2026: PwnEscape is fixed by your host, Vghost on your VPS. Check the kernel, update it and schedule the reboot.
PgBouncer 1.26.1: fix CVE-2026-107350 (SCRAM bypass)
PgBouncer 1.26.1 fixes CVE-2026-107350, a SCRAM authentication bypass. Check your version, port 6432 exposure, apt and Docker upgrades, workarounds and log review.
Node.js CVE-2026-111497 (Brotli): update to 22.23.4
Node.js 22.23.4, 24.22.1 and 26.12.1 fix CVE-2026-111497, an out-of-bounds write in the Brotli decoder. Exposure check, fleet inventory, updates, mitigations.
CVE-2026-110447 Nextcloud Collabora: update or remove the app
CVE-2026-110447: the richdocumentscode app lets attackers run commands without authentication. Affected versions, inventory, fix, and how to hunt for traces.
PHP version inventory for client sites: an agency method
Build a register of the PHP version served by every client site across several hosts: access tiers, batch scripts, priority batches, client message, dated proof.
Debian 11 end of life: Plesk dist-upgrade or migration?
Debian 11 no longer gets security fixes. Plesk dist-upgrade to Debian 12 or migration to a new server: decision criteria and a step-by-step procedure.
Disk full and RAM alerts on a VPS, no monitoring stack needed
Six shell alerts for your client VPS: disk, inodes, OOM, systemd services, certificates, backups, plus a heartbeat that watches the check itself.
PHP2Shell and Docker: rebuild your PHP and WordPress images
An updated WordPress or Laravel does not change the PHP in your Docker image. Prove the served version, spot which tags moved and rebuild without traps.
Next.js 16.4.1 and 15.5.28: patch the RCE flaws on a VPS
Two critical RCEs and one DoS fixed in Next.js 16.4.1 and 15.5.28. Affected versions, VPS exposure checks, and PM2, Docker and Coolify redeploys.
Grafana Alloy on a VPS: install it and migrate from Promtail
Install Grafana Alloy on your VPS, collect logs and metrics with a single agent, and migrate from Promtail without losing logs or sending them twice.
OpenSSH 10.6: update sshd without losing access
OpenSSH 10.6 security update: check the version actually running, what may break (ProxyCommand, Compression) and reload sshd safely.
Root DNSSEC KSK rollover: check your validating resolver
The DNS root is now signed by KSK-2024 (key tag 38696). Check the trust anchor of Unbound, BIND, Knot Resolver, systemd-resolved or dnsmasq, and fix it.
nginx CVE-2026-15176: audit and patch to 1.30.6
nginx 1.30.6 and 1.31.7 fix five flaws, including CVE-2026-15176. Affected versions, config audit commands, updates per system and mitigations.
PHP2Shell: patch CVE-2026-109618 and CVE-2026-109619
PHP2Shell: two critical PHP flaws exploitable without an account. Patched versions, update commands per system and temporary mitigations.
Rybbit: the self-hosted PostHog alternative on VPS
PostHog deprecated its Community Edition. Rybbit, Apache-2.0 licensed, installs in 30 minutes on a VPS and covers the same use cases without the constraints.
Self-hosted Opsgenie alternatives before April 2027
Opsgenie shuts down on April 5, 2027. Learn how to migrate to OneUptime or IncidentRelay, two open source tools deployable on a VPS in under an hour.
Pocket ID: lightweight OIDC provider in one container
Pocket ID v2.18.0 is a self-hosted OpenID Connect provider in a single Docker container, no external database, passkeys only, under 50 MB RAM at idle.
Proactive VPS monitoring: Beszel and Uptime Kuma v2
Deploy Beszel and Uptime Kuma v2 on a VPS to monitor your entire server fleet and receive Telegram or SMTP alerts before your clients notice the outage.
Self-host Wazuh on a VPS: full SOC in under an hour
Deploy Wazuh 4.14 as a single node via Docker Compose on your VPS. Log management, incident detection and NIS2 art. 21 compliance under your control.
Self-Hosting ZITADEL on a VPS: Multi-Tenant SSO Without Keycloak
Deploy ZITADEL on your VPS with Docker Compose: cloud-native IAM in Go, native multi-tenancy, OIDC, OAuth2, SAML and Passkeys — without Keycloak's complexity.
CVE-2026-21589: patch Atlassian now
CVE-2026-21589 is an unauthenticated path traversal (CVSS 9.3) affecting all Atlassian Data Center products. Learn which versions to patch.
Migrate from Bitwarden Cloud to Vaultwarden on a VPS
Migrate everything from Bitwarden cloud to Vaultwarden: logins, organizations, and attachments — nothing left behind. Full CLI guide with troubleshooting.
Pi-hole v6 on a VPS: block ads and trackers at the DNS level
Deploy Pi-hole v6 on your VPS with Docker Compose, secure your DNS resolver and block ads and trackers for all your self-hosted services.
Wazuh Open Source SIEM on a VPS: Monitoring and Compliance
Deploy Wazuh open source SIEM on your Linux VPS to centralize logs, detect intrusions and automate PCI-DSS, HIPAA and GDPR compliance.
VPN mesh with no open ports using NetBird on VPS
Connect your VPS, offices, and remote workstations in a private mesh network without opening a single public port, using NetBird v0.76 and the netbird expose command.
5 signals to assess a self-hosted app's long-term viability
Before deploying an open-source app for a client, five measurable indicators to know whether it will hold up over time — governance, funding, licence and more.
Automatic Security Updates on Debian/Ubuntu VPS
Configure unattended-upgrades on your Debian/Ubuntu VPS to automate security patches and reduce attack surface across your client fleet.
Dokploy CVE-2026: Critical Update to 0.29.13
Two CVSS 10.0 and 9.9 CVEs in Dokploy chain together: forgeable admin JWT without an account + root shell via WebSocket. Patch guide to ≥ 0.29.13.
WordPress CVE-2026-87902: Update to 7.1.2 Now
CVE-2026-87902 (CVSS 9.2) actively exploited since Sept. 22, 2026. Check your version, apply WordPress 7.1.2, and see why shared hosting extends exposure.
Keycloak v26.7.4: 6 CVEs — migrate to Authelia or ZITADEL
Keycloak v26.7.4 patches 6 CVEs including two unauthenticated DoS. For fewer than 10 SSO apps on a VPS, Authelia (< 30 MB) or ZITADEL cut the attack surface.
Docker Secrets in production: protecting secrets on a VPS
Manage Docker secrets in production without exposing them in docker-compose.yml. Docker Secrets without Swarm, .env.vault and SOPS: method and comparison.
CVE-2026-85706 GitLab: emergency patch or Gitea migration
CVE-2026-85706 (CVSS 10.0) exposes secrets.yml and SSH keys on GitLab 18.7–19.3.1. Patch to 19.3.2 immediately or migrate to Gitea on a VPS.
CVE-2026-82329 Artifactory: patch & self-hosted alternative
CVE-2026-82329 (CVSS 9.8) lets attackers write into JFrog Artifactory repos and plant a Rust backdoor in CI/CD pipelines. Patch now or migrate to Gitea Packages.
n8n CVE-2026-21877: patch critical RCE CVSS 9.9 now
CVE-2026-21877 enables authenticated remote code execution in n8n (CVSS 9.9). Update to ≥ 1.121.3 and apply the scheduling workaround.
3-2-1 Backup Strategy for Your VPS with Restic and S3
Build a complete 3-2-1 strategy on your VPS: Restic to Backblaze B2 or Cloudflare R2, systemd timer, retention policy and automated restore test.
Patching PostgreSQL (CVE-2026-6471, -14669) on VPS
Two critical PostgreSQL flaws fixed on August 13, 2026: replication access to RCE and heap overflow to RCE. How to patch your self-hosted instances via apt and Docker.
Linux VPS Hardening Checklist for Agencies
Reproducible Linux hardening checklist for agencies: auditd, sudo user, SSH key auth, UFW, fail2ban and root lockout — with per-client traceability.
Migrating from 1Password to Vaultwarden: the complete guide
Export your 1Password vault as .1pux, import it with Bitwarden CLI and deploy Vaultwarden on a VPS — full migration in under an hour.
Passbolt on VPS: auditable team password vault, no subscription
Deploy Passbolt Community Edition on your VPS with Docker and PostgreSQL: per-recipient GPG encryption, per-entry audit log, REST API — zero SaaS subscription.
Migrating Uptime Kuma from v1 to v2: security guide
CVE-2026-45618 exposes Uptime Kuma 1.x to remote code execution. Migrate to v2 and harden your instance with this step-by-step guide.
Exposed backoffice on VPS: the overlooked attack surfaces
Four August 2026 CVEs share the same pattern: exposed backoffice, compromised account. Application authentication alone is not enough.
Authentik, Authelia or Keycloak: Choosing Your SSO on VPS
Authentik, Authelia or Keycloak on VPS: compare real memory footprint, covered protocols and Keycloak 26.7.1 CVEs to choose the right self-hosted SSO.
SigNoz on VPS: Open-Source APM in 15 Minutes
Deploy SigNoz on your VPS and instrument Node.js, Python and Go apps via OpenTelemetry SDK. Traces, metrics, logs, alerts and ClickHouse retention configured end to end.
Centralize Docker logs on your VPS with Loki and Grafana
Aggregate logs from all your Docker containers into a single Grafana dashboard using Loki and Promtail on your VPS. No Datadog, no quota.
Initial Linux Server Hardening
Create a sudo user, configure SSH with keys, enable UFW and fail2ban on Ubuntu or Debian in under an hour.
Self-hosted apps: the patching routine
Inventory, security advisories, a patch window, backups and post-checks: the routine most self-hosted estates are missing.
Grafana Tempo and OpenTelemetry: distributed tracing on VPS
Deploy OpenTelemetry + Grafana Tempo on your VPS: complete architecture, step-by-step setup, Node.js/Python instrumentation, S3 retention, and TraceQL queries.
Short TLS certificates: automate with ACME
Let's Encrypt moves to 64-day certificates on February 10, 2027, then 45 days. Timeline, ARI and a checklist for certbot, acme.sh, Caddy, Traefik, nginx.
AI Crawlers: taking back control over your clients' sites
Cloudflare now splits AI crawlers into three families. How to configure robots.txt and Cloudflare rules to protect your clients' sites.
Self-host Backrest on a VPS: encrypted backups, no command line
Deploy Backrest on your VPS to schedule encrypted, deduplicated restic backups to Backblaze B2 or S3, and restore a single file in a few clicks from the browser.
Self-host ntfy on a VPS: push notifications for scripts and CI/CD
Deploy ntfy on your VPS and send push notifications from any script, cron job or CI/CD pipeline with a plain curl — no SaaS, no API key, no subscription.
Self-Host Authentik on a VPS: Open-Source Auth0 Alternative
Deploy Authentik on a ServOrbit VPS for a full IdP (OIDC, SAML 2.0, passkeys, visual flows) to unify authentication across your entire self-hosted stack.
Self-host Glance: your startpage dashboard on a VPS
Deploy Glance self-hosted on a ServOrbit VPS: Hacker News, RSS, CPU/RAM/Docker on one page — YAML config, docker.sock security, troubleshooting, agency use cases.
Self-Host Headscale on a VPS: Your Own Tailscale Control Server
Replace Tailscale's cloud control server with Headscale on your own VPS — unlimited users, full WireGuard mesh networking, magic DNS and ACLs, with no SaaS dependency.
Bastion Host on VPS: securing your SSH access
Deploy a Bastion Host on a ServOrbit VPS: a hardened SSH entry point, centralized access, logs and security rules.
Self-hosting Authelia on a VPS: MFA and SSO for your entire stack
Deploy Authelia on a VPS with Docker Compose: TOTP, WebAuthn/passkey, OIDC, LLDAP migration, Prometheus monitoring, and comparison with Authentik.
Deploy Vaultwarden on a VPS: self-hosted password manager
Self-host Vaultwarden on a VPS: password management, Bitwarden compatibility, team vaults and TOTP, at a fixed monthly cost and under 50 MB of RAM.
Monitoring your VPS with Uptime Kuma
Deploy Uptime Kuma on your VPS to monitor your sites and services self-hosted, with alerts and a public status page.
VPS Monitoring with Grafana and Prometheus
Deploy Prometheus 3.x, Grafana 13.x, Node Exporter and Alertmanager on your VPS with Docker Compose. Dashboards, alerts and hardening.
Monitor your VPS in real time with Netdata
Install Netdata on your VPS for per-second real-time monitoring: thousands of metrics, zero configuration, alerts included.
Securing your VPS with CrowdSec
Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.
Fail2Ban Enhanced on VPS: blocking repeated attacks
Link Fail2Ban Enhanced to the ServOrbit catalog: SSH/Nginx banning, readable logs and official documentation.
Setting up a WireGuard VPN on your VPS
Deploy a WireGuard VPN on your Cloud VPS: encrypted tunnel, Docker configuration and clients in a few minutes. Step-by-step guide.
Centralizing authentication with Authentik on VPS
Centralize the authentication of all your apps with self-hosted Authentik on a VPS: SSO, MFA and forward auth in Docker Compose.
Deploy Keycloak for SSO on Your VPS
Deploy Keycloak on your VPS for enterprise-grade SSO: OIDC, SAML, realms and federation. A complete Docker guide and comparison.
Automate Your VPS Backups with Restic
Automate your VPS backups with Restic: encrypted snapshots, deduplication and shipping to S3 or any object backend.
Encrypted VPS Backups with BorgBackup
Back up your VPS with BorgBackup: powerful deduplication, authenticated encryption and compression. A complete guide and Restic comparison.
Configure Your VPS Firewall with UFW
Configure your VPS firewall with UFW step by step: rules, ports, SSH rate limiting and best practices to reduce the attack surface.
Free SSL Certificates with Let's Encrypt on a VPS
Complete Let's Encrypt guide for VPS: certbot nginx, DNS-01 wildcard, systemd renewal, TLS hardening, rate-limit troubleshooting and certbot vs acme.sh vs Caddy.
Imunify360: server security explained
How Imunify360 works: WAF, real-time antivirus, PHP Proactive Defense, KernelCare, network firewall and patch management for cPanel/WHM servers.
Beszel on VPS: multi-server monitoring, alerts and security
Deploy Beszel on a VPS, monitor your entire fleet from one hub, set up Telegram/email alerts, enable 2FA and fix silent agents, TLS errors and blocked ports.
OpenVPN on VPS: install, harden and troubleshoot
Install OpenVPN Server on your VPS: prerequisites, Easy-RSA, server.conf, .ovpn profiles, fail2ban, ufw and common error troubleshooting.
WireGuard on a VPS: a fast, lean and private VPN
Deploy WireGuard on a ServOrbit VPS: fast tunnels, readable configuration, client QR codes and private remote access.
Prometheus on a VPS: clear, durable monitoring
Install Prometheus on a VPS to collect metrics, export the state of your services and prepare reliable alerts.