Four Security Updates in One Week: Your Self-Hosted Stack Had a Busy October

The quiet bargain of self-hosting is that you trade subscription fees for responsibility. No vendor silently patches your server at 3 a.m. The updates arrive, they are yours to install, and sometimes they arrive all at once. This week, that is exactly what happened: four of the most popular self-hosted applications shipped security-driven point releases within three days of each other.

The four were Duplicati, Radicale, Vaultwarden, and FreshRSS. Backups, calendars and contacts, a password vault, and an RSS reader. For a lot of homelabs, that is close to the entire application layer of a typical stack, and it meant four separate update obligations in a single week rather than one. None of them carried assigned CVEs, but each addressed disclosed security issues, including a named Radicale auth flaw tracked as FO-RAD-2026-001.

Nothing here suggests the projects are doing something wrong. If anything, the opposite: four maintainers disclosing and fixing security issues promptly is open source working as designed. But the week is a useful stress test of how you run your own infrastructure, and the Vaultwarden update in particular deserves your immediate attention.

The Vaultwarden update you should not postpone

Vaultwarden 1.37.4 landed on October 5 with seven published advisories, the heaviest of the four releases by a clear margin. The worst is rated High, with a severity score of 8.1: revoked organization members could keep access to a vault even after an administrator removed them. The advisory reference is GHSA-69q9-v8p6-xvx3. The remaining advisories touch two-factor login, invitations, attachments, event logs, and cipher sharing.

Read that again. A password manager is the one piece of self-hosted infrastructure where an authorization bug is not a theoretical concern; it is the crown jewels. Vaultwarden is an unofficial Bitwarden-compatible server, written in Rust, and it is widely deployed in homelabs precisely because it is small and light: around 128 MB of RAM, typically a single Docker container, with an SQLite database that makes the whole thing feel nearly free to run. That lightness is why so many of us run it, and it is also why so many of us forget it is there.

There are no public reports of this specific flaw being exploited in the wild. But access-control bugs in password vaults are exactly the kind of thing attackers look at closely, and "revoked users keep access" is the kind of flaw that is trivially weaponized by someone who knows they were kicked out. If you run Vaultwarden with organization features enabled, treat 1.37.4 as a patch-now release, not a patch-when-convenient one.

You do not self-host to avoid security updates. You self-host so that you get to choose when they run, and this week the choice was made for you.

What the other three fixed

Radicale 3.8.3 patches an authentication bug. Radicale is the lightweight CalDAV and CardDAV server many homelabs use instead of the calendar stack inside Nextcloud, and an auth flaw there is directly adjacent to your contacts and calendars. The flaw has its own identifier, FO-RAD-2026-001, which suggests the disclosure was coordinated enough to get tracked. The release arrived the same week that Radicale 3.8.2 had already added read-only free/busy views, sharing tokens, and a WebUI calendar URL, so if you updated recently for features, you still need the follow-up for security.

FreshRSS 1.30.1 is a security-oriented follow-up to 1.30.0, shipping patches and bug fixes on top of the feature release. FreshRSS is one of the most deployed self-hosted RSS readers, and like most PHP applications with a long changelog, it accumulates the kind of small, boring security fixes that individually sound harmless and collectively are exactly what keep a web-facing app safe. It sips RAM, around 256 MB, runs happily in a small container or LXC, and tends to sit exposed behind a reverse proxy because that is the whole point of a feed reader you check from your phone. Update it the same way you would any internet-facing PHP app: promptly.

Duplicati, the backup tool, rounds out the four with its own security-driven release in the same three-day window. There is a particular irony in your backup software needing a security patch, but consider the alternative: backup software that handles encrypted archives and, in many setups, cloud credentials, running with a known vulnerability. The recent Duplicati stable line has also been hardening its data folder permissions, even breaking some setups to do it, which tells you the maintainers are taking the security posture seriously.

The real lesson: your update process

Four updates in three days sounds dramatic, but this is what a healthy self-hosted ecosystem looks like from the inside. Open-source projects fix things, and when four projects fix things in the same week, you notice. The question the week really asks is procedural: how long does it take you to go from "a security release exists" to "my instance is patched"?

If the answer is measured in weeks because you update by hand when you remember, this is the week to reconsider. The homelab community has two reasonable answers, and both are fine. The first is automation: tools like Watchtower can watch your containers and update them, though many experienced self-hosters configure it to notify rather than auto-apply, because a surprise major-version bump at midnight has its own failure modes. The second is a routine: a weekly check, every Sunday morning with coffee, of your Portainer dashboard or your compose files against new releases.

Whichever you choose, the order of operations for a security week like this one is the same. Back up before you update, which for Vaultwarden means snapshotting its SQLite database and for FreshRSS means backing up its data directory. Update the highest-risk service first, which here is Vaultwarden, then work outward. After updating, verify the service actually starts and serves, because a patched service that fails to boot is just a different kind of outage. And check the project's release notes for breaking changes before pulling the trigger; Duplicati's recent permission hardening is a good reminder that security fixes sometimes change behavior.

Self-hosting gives you control, privacy, and freedom from subscriptions. It also gives you this job. Four patches, three days, one weekend of quiet competence, and your stack is current again. That is the deal, and this week it was honored in full.