Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let’s dive in!
As a homelab enthusiast, I found this a very interesting post. Here are my take aways from the post that I’m implementing myself:
- Miner detection. I’ve updated monitoring rules to now watch the CPU on my hosts. If the same thing happened to me I would not have been alerted at all as I’m doing simple up / down monitoring. Fixed.
- Access logging. I turned on access logging for my homelab Caddy instances.
- Log retention. I have increased the amount and retention of my logging. The hope is this will help me reconstruct what happened after a breach.
- Logs offsite. The VPS access logs now ride along with the normal backup process, which runs hourly. The homelab side still only gets caught by the weekly VM backup, so that’s next.
- Closed an open signup. My webtrees instance (genealogy) had self registration enabled, which is the same door this guy got hit through. Oops. Fixed.
- Built a tool.
log-inventory.sh, so “could I actually reconstruct what happened” is a command I run instead of a thing I assume.
Firewalling containers’ outbound access seems to be rare but another powerful layer of protection
Glad I am not selfhosting or doing homelab, It is so out of my legau.
Don’t let this discourage you.
You can self host on your local network just fine and never portforward which is what exposes it to the outside.
I don’t need to watch tv or upload pictures to my server outside of my home. Its perfectly useable.
When you are ready and feel more confident you can setup your own wireguard vpn and only expose that.
Then Your device can connected to that vpn tunnels inside and can acces everything like home.
Currently without vpn your device is at risk every time it connects to a network you don’t own. A third party vpn is not a guarantee your data is safe either. Your home vpn though means all your outside the home networking is fully encrypted and outsiders cant even detect your home adresses is running a vpn to hack. (No ping unless you have the key)
I have a lot of stuff self-hosted.
Just no outside access. Well, that’s not quite true, I do have a Tailscale VPN for remote management, but only certain machines are allowed to join, joins require my authorization, and access to the account is via two-factor.
The big thing with external access is to never permit it directly through your local connection. Do it though a Virtual Private Server (VPS) - let it get hit with access attempts. And then only allow specific traffic from the VPS to a specific service in your network using a VPN of some sort.
My server got hacked once and was mining crypto! I noticed it when I heard the fans were at 100% when walking passed the room lol. Turns out, qbittorrent-nox used UPNP for its web admin endpoint enabled by default and qbittorrent can do many things like run custom scripts. My mistake was not changing its login credentials. Exposed my full system. Live and learn.
UPNP is a security nightmare, better to never enable it at all or if you must only for those networks where you need it.
About the only recent even I’ve had was when I was sitting at my desk reading an article. I noticed the mouse slightly move, but I hand no hand on the mouse. I sit there watching it, not manually moving the mouse or typing on the keyboard. It really freaked me out. Turns out, my old desk pad had a slight curl towards the edge the mouse was at, and the curl would make the mouse sense movement ever so slightly. I deployed a new desk pad, and things are back to normal. Whew!
I hate providers not offering me a latest tag. Is there any valid reason not to do that?
Even worse, super stupid version tags such as MinIO is using:
RELEASE.2025-09-07T16-13-09Z-cpuv1(I wish I made that up)I’m thinking of adding Falco to my homelab.
Thanks for posting that. I hadn’t heard of falco before. Cncf graduated, open source, cloud native. I’m going to give this a shot.
Thanks for this! I didn’t understand any of it, but I hope to eventually.
The real takeaway is to run your containers ALL as read-only. There’s no way to run executables like this as read-only. They’d download to /tmp but not have executable access and womp womp.
Many things aren’t read-only friendly, but so far I’ve found all containers can be beat into read-only mode! (Heimdall is one of the worst, shout out to it)
Good write up! Since you’re using Komodo already, are your compose stacks in git? Because if they are, check the renovate bot. It will read your files with their pinned image tags, check upstream for newer tags, and creates MRs (can also be set to auto merge) to update. Can be configured per stack.
What’s komodo? I’m thinking of starting a home server so learning how to harden/automate updates (which is what it sounds like you’re saying) is what I want to learn.
It’s a tool to manage docker stacks, e.g. by reading them from git repos. You can configure your git forge in a way to ping Komodo when something in a repo changed, Komodo then deploys the new version. You’d need your own git forge, e.g. forgejo. This is a good guide:
You can start without Renovate to get going, but you’ll want it sooner or later to automate checks for updates.
OIDC and zero signups for everything. I’ve been very happy with Pomerium (ZTNA) + Keycloak for all my public facing apps, although the free version doesn’t have any client signals which I was hoping for when I starteed.
My project this week is integrating the app logging I have into Crowdsec and start having Crowdsec do more analysis.
Yiiiiiikes. This is why I’m gonna be stuck on tailscale or another VPN only access for quite a while. I know it’s not perfect, but exposing ports on today’s Internet is scary.
I know I don’t have the mental overhead to secure literally everything, and have a solid contingency for when some botnet armed with a zero-day inevitably breaks it.
Really glad this person wrote this write up about how that happens and what it looks like though. It’s REALLY interesting and I learned a lot!
I should really do a security checkup on my setup…
Have you thought about log aggregation with something like Prometheus/graphana or ELK?
Lol thinking about cpu notifications for myself. I get notified when the fans ramp up on my server.
Also feed it to wazuh
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters CA (SSL) Certificate Authority DHCP Dynamic Host Configuration Protocol, automates assignment of IPs when connecting to a network DNS Domain Name Service/System Git Popular version control system, primarily for code SSH Secure Shell for remote terminal access TLS Transport Layer Security, supersedes SSL VPN Virtual Private Network VPS Virtual Private Server (opposed to shared hosting)
8 acronyms in this thread; the most compressed thread commented on today has 13 acronyms.
[Thread #97 for this comm, first seen 7th Sep 2026, 20:40] [FAQ] [Full list] [Contact] [Source code]
