Homelab

Proxmox VE is an incredible virtualization platform, but a fresh install needs hardening before it’s production-ready. This guide covers everything from basic configuration to advanced security controls. Prerequisites Proxmox VE 8.x installed on bare metal Physical access or IPMI/iKVM for recovery Basic Linux command line familiarity 1. Repository Configuration Disable Enterprise Repositories By default, Proxmox uses enterprise repositories that require a subscription. For homelab use, switch to the community repositories: ...

This week the theme is trust erosion — in the tools that protect us, the chips that boot our devices, the certificates that vouch for software, and the platforms that host our code. Microsoft Defender, the very security product meant to protect Windows endpoints, has two actively exploited zero-days: one that grants SYSTEM and another that kills antimalware. Qualcomm’s BootROM — the immutable root of trust in billions of devices — has a write-what-where condition that turns a phone repair into a persistence attack. Fox Tempest operated a malware-signing-as-a-service that generated over a thousand fraudulent code-signing certificates, enabling ransomware operators to dress their payloads in legitimate Microsoft signatures. And GitHub is under coordinated assault from multiple directions: Megalodon hijacks repositories through malicious workflows, TeamPCP poisons VSCode extensions, and Socket discovers malicious postinstall hooks across 700+ repositories. Meanwhile in the lab, OpenClaw got a feature-heavy upgrade, Obsidian CLI integration landed, the package tracker got a rewrite, and the homelab held steady with new Proxmox snapshots. ...

This week proves that old vulnerabilities never die — they just wait for someone to look. NGINX Rift is an 18-year-old heap buffer overflow in the rewrite module that delivers RCE, discovered by an autonomous code analysis system. Exim’s Dead.Letter achieves unauthenticated remote code execution through a use-after-free triggered by a single stray byte in GnuTLS. Palo Alto ships a second PAN-OS RCE in two weeks — this time in IKEv2 processing. Microsoft’s May Patch Tuesday delivers 137 CVEs including critical Windows Netlogon and DNS overflows. And GreenPlasma (SB2026051378) continues Chaotic Eclipse’s disclosure campaign with a ctfmon.exe section hijack that escalates standard users to SYSTEM on Windows 11. Meanwhile in the lab, Pupy C2 completed its Python 3 migration, Nextcloud got a major version upgrade, Tailscale funnel replaced port forwarding for Plex remote access, and Max’s weekly audit found critical firewall gaps across two homelab hosts. ...

This week is a gut check for anyone who thinks patching is optional. A Palo Alto firewall zero-day gives unauthenticated root — and it’s been exploited since April 9. ShinyHunters breached Canvas LMS, stole data from 8,800 schools, then defaced 330 university login portals during finals week. DigiCert, one of the world’s largest certificate authorities, was compromised through a malicious screensaver file that led to stolen code-signing certificates. RansomHouse hit Trellix, the cybersecurity firm born from the McAfee/FireEye merger. Ivanti dropped another EPMM zero-day — their third this year — and CISA gave agencies just three days to patch. And the vm2 Node.js sandboxing library has another escape, this time via WebAssembly. Meanwhile in the lab, we deployed Termix + Apache Guacamole for browser-based remote access, killed Gmail’s Smart Features, and took a hard look at homelab attack surfaces after Max’s weekly audit. ...

This week’s threat landscape is defined by four words: patch everything, immediately. A cPanel authentication bypass has been exploited in the wild since February. A nine-year-old Linux kernel flaw gives reliable root without winning a race condition. GitHub Enterprise had a command injection bug triggered by a single git push. And the Windows Shell spoofing patch from February? Incomplete — attackers are still stealing NTLM hashes through LNK files. Meanwhile in the lab, Momentum Fusion v3 shipped with swing mode, Max found .env files with group-readable permissions, and the homelab security posture needs tightening. ...

The threat landscape this week shifted from last week’s Windows Defender zero-days to infrastructure-level attacks: a state-sponsored backdoor surviving firewall patches, an emergency Microsoft patch for ASP.NET Core, and an iOS flaw that let law enforcement recover “deleted” Signal messages. Meanwhile in the lab, Momentum Fusion went live, Nextcloud got hardened, and the Obsidian knowledge base doubled in size. Cisco FIRESTARTER: A Backdoor That Survives Reboots (and Patches) Cisco Talos published a detailed technical analysis of UAT-4356, the same state-sponsored actor behind 2024’s ArcaneDoor campaign, now targeting Cisco Firepower devices with a custom backdoor dubbed FIRESTARTER. ...

Windows Defender Is the Target Now This week’s headline isn’t about some exotic exploit kit. It’s about the security tool itself getting owned. Three zero-days targeting Microsoft Defender — BlueHammer, RedSun, and UnDefend — have shifted from proof-of-concept to active in-the-wild exploitation. All three come from the same researcher (Nightmare-Eclipse / Chaotic Eclipse), who released exploit code publicly in protest over Microsoft’s handling of the disclosure process. Huntress Labs has confirmed hands-on-keyboard attackers combining these with compromised SSL VPN credentials for real intrusions. ...

After years of cobbling together scripts, cron jobs, and manual SSH sessions, I found OpenClaw — a framework for building personal AI assistants that actually understand your infrastructure. Here’s how I turned it into Clawd, my homelab orchestrator. What is OpenClaw? OpenClaw is an open-source framework for running personal AI assistants. Unlike cloud-based options (ChatGPT, Claude, Gemini), OpenClaw runs on your hardware with your choice of LLM backend. Key features: ...

Running your own LLMs isn’t just about privacy — it’s about control, cost predictability, and learning how these models actually work under the hood. Ollama has become my go-to for local inference, and here’s how I’ve integrated it into my homelab. Why Local LLMs? Before we dive into setup, let’s address the elephant: why bother when ChatGPT and Claude exist? Factor Cloud LLM Local (Ollama) Privacy Data sent to third-party Stays on your hardware Cost Pay per token Free after hardware Latency Network-dependent Milliseconds Control Provider’s rules Your rules Offline Requires internet Works anywhere For homelab use cases — log analysis, code review, documentation generation — local models are often good enough and infinitely cheaper. ...

Managing a homelab is a constant battle between “set it and forget it” and “everything is on fire.” After years of manual script maintenance, I decided to build Clawd — a hierarchical AI assistant that orchestrates my entire infrastructure. The Problem Every homelab owner knows the drill: SSH into multiple machines to check status Remember which scripts need to run when Monitor services across Proxmox VMs, Docker containers, and NAS Keep track of updates, backups, and security alerts My solution? Build an AI that understands my infrastructure and can execute tasks on my behalf. ...