PHP2Shell: Migrating a Self-Hosted HumHub from humhub-dev to the Official Docker Image

by

On 21 October 2026 the PHP project shipped emergency releases for two critical remote code execution bugs in the PHP engine, CVE-2026-109618 and CVE-2026-109619, better known as PHP2Shell. Details had leaked a day earlier and exploitation started almost immediately. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

One of the things I host is a HumHub instance, running in Docker behind NPMplus. I took it off the web straight away (NPMplus host disabled, a wildcard redirect pointing to a maintenance notice) and kept the containers running in the background so I could work on the update. This post is the write-up of that update: it turned into a full migration, and a few of the pitfalls are worth sharing.

Read more

Upgrading OPNsense from 25.7 to 26.7 on UFS (no ZFS snapshots): ISC DHCP, Zenarmor and a Git config backup

by

My OPNsense firewall was still on 25.7.11_9, while the firmware page offered 26.7.7. That is two major releases in one go: 26.1 moved ISC DHCP out of the core, and 26.7 switched the base system from FreeBSD 14.3 to 15.1 and OpenSSL from 3.0 to 3.5. To make it more interesting, the box was installed on UFS years ago, so there was no ZFS boot environment or snapshot to roll back to. This post covers what changed, what I cleaned up beforehand, how the upgrade went and what the logs said afterwards.

Read more

Upgrading self-hosted Pangolin Enterprise Edition from 1.21 to 1.25.3 (and patching Node2Shell)

by

Pangolin is the tunneled reverse proxy in front of most of my self-hosted services. It runs as a small Docker Compose stack of Pangolin, Gerbil (WireGuard) and Traefik on a VPS. Mine was still on the Enterprise Edition image ee-1.21.0. When Node2Shell (CVE-2026-111497) was published for Node.js, it was time to catch up four minor versions. This post covers the path I took, the versions that belong together, and how I verified the result.

Read more

Upgrading a neglected Redmine: PostgreSQL 9.6 → 15 and Redmine 5.0 → 6.1 in Docker

by

While checking my homelab for PHP2Shell, I took a closer look at my Redmine install. It isn’t PHP (Redmine is Ruby on Rails), but what I found was bad enough: sameersbn/redmine:5.0.2 from 2022 and sameersbn/postgresql:9.6, a database version that went end of life in 2021. Redmine 5.x is end of life too. Time to fix it properly, and to write it down for next time.

The last time I touched this install was in 2022, when I restored a 2017 backup into Redmine 5.0.2. This post picks up where that one left off.

Read more

PHP2Shell: patching a custom Nextcloud Docker image (and the :latest trap)

by

After patching my WordPress stack for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the next one on the list was Nextcloud. It deserved more care: it holds my files, and it runs on the official nextcloud:apache image, which means Apache with mod_php, the setup where the confirmed exploit fires before any application code runs.

Read more

PHP2Shell: patching my Dockerized WordPress in five minutes

by

On 21 October 2026 the PHP project shipped an emergency release for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow remote code execution without logging in. Details had leaked a day before the planned disclosure, so the patch window was short. This is a quick write-up of how I patched the WordPress stack that runs this blog.

Read more

A hardened Hetzner Cloud server with Docker in one cloud-init file (2026 edition)

by

When I spin up a new Hetzner Cloud VM, I paste a cloud-init file into the “Cloud config” box and let the server set itself up. Hetzner’s community tutorial has a nice baseline: a sudo user, SSH moved to port 2222, root and password logins disabled, fail2ban and ufw. What it doesn’t have is Docker. This post is the version I actually use, plus a few things I corrected after checking it against current documentation.

Read more

Isolating a guest VLAN on OPNsense with a Ruckus AP: no sneaking through to the main network

by

My Ruckus access point broadcasts a dedicated guest SSID and tags that traffic with a separate VLAN before handing it to OPNsense. The AP side is easy – Ruckus does the tagging reliably. The router side is where things go wrong if the firewall rules are in the wrong order or a step gets skipped. Here is the full setup I use to make sure a guest really cannot reach anything on the internal network.

Read more

Deploying LXC containers at scale on Proxmox: cloud-init alternatives

by

Every time I spin up a new LXC on Proxmox, I ask myself the same question: why can’t I just hand it a cloud-init file like I do with VMs? The short answer is that cloud-init is a VM-only feature in Proxmox. LXC containers don’t support it natively. But there are several approaches that get you to the same place — or better.

This post covers the options, the trade-offs, and what I actually use for a fleet of Ubuntu + Docker + Docker Compose + Dockge containers.

Read more