HomeAssistant Core 2026 9 4: integration, logging fixes, Tuya fans off at speed 0, deps bumped Enphase and Xbox, HTTP scan cost accuracy improved
Cloudflare WAF WordPress XSS detection now has a cleaner CVE label, but the behaviour has not changed; the rule still blocks the same traffic, just with less guesswork when I am reading logs. The deprecated command injection obfuscation entry is a different story, because that coverage has simply been retired.
Cloudflare Turnstile siteverify is the bit that matters, not the widget on the page. I have seen too many setups that look protected until you replay the same token and watch the backend wave it through; that is not security, just decoration.
Cloudflare WAF scheduled release is one of those updates I trust less when it sounds tidy. Log-only first is sensible, because a fresh SQLi signature can look convincing right up until it starts flagging perfectly ordinary traffic.
Cloudflare’s shift from log-only to blocking for vBulletin exploit traffic is the sort of change I prefer, boring and effective. Cloudflare WAF vBulletin RCE detection now does something useful by default, which is more than I can say for a lot of security alerts.
Prometheus v3 15 0: PromQL correctness and tracing, TSDB XOR2 stability, scraping and discovery features, runtime and remote write tweaks, stability fixes
Prometheus v3 15 0: PromQL correctness fixes, TSDB storage performance and safety, scraping and UI improvements, runtime and remote write optimizations
n8n release: observability bug fixed, project span attributes now propagate to node spans, improving trace correlation and debugging, no workflow changes
Nextcloud v35 0 1: urgent security hotfix and bug fixes for uploads, sharing, performance, DB reliability, app API and admin tools, upgrade immediately
Vector vdev v0 3 24: maintenance patch for stability, reliability and small enhancements, review release notes before upgrade, backup configs, test in staging
Nextcloud v35 0 1: security fixes and urgent upgrade, file sync and search fixes, performance and DB improvements, admin and app upgrade guidance
n8n 2 40 6: Restores OpenTelemetry export on restart with Sentry, retries reports crossing UTC midnight, authenticates reports with license certificate
Cloudflare Gateway package registry security only becomes useful once TLS is decrypted, because the package name, version, and namespace live inside the request, not on the outside. I prefer to test with one narrow allow rule and one block rule, then see whether Gateway can actually read what I think it can.
headscale v0 29 4: mapper and peermap fixes, OIDC hardening, node lifecycle and expiry fixes, metrics and ACME fixes, DNS policy, exit node and CLI fixes
headscale v0 29 4: OIDC hardening, mapper and peer map fixes, DNS and exit node reliability, metrics and shutdown fixes, min Tailscale v1 80 0
Vector vdev v0 3 21 released 20260922: no release notes, check tag and compare view for commits, backup configs, test in staging before upgrade
n8n 2 40 5: Patch limits declarative routing during base URL ownership checks, preventing misrouted requests for webhooks, custom domains, upgrade recommended
Vector vdev v0 3 20 release: features, fixes, perf and security updates, upgrade and migration notes, artifacts and verification on the official release page
Telegraf v1 40 1: bug fixes and plugin fixes for stability, outputs hardened, deps updated, multiarch packages available, see release for downloads
Telegraf v1 40 1: bugfixes for aggregators, inputs, outputs and processors, dependency bumps, multi platform packages, upgrade recommended for affected plugins
n8n 2 39 10: Limits declarative routing during base URL ownership checks, prevents incorrect ownership detection and routing side effects, deploy recommended
A stolen Google Workspace OAuth tokens grant can outlive a password reset and keep reading mail quietly, which is the bit I dislike most. If it reaches Drive or a connected app, the damage is rarely tidy, and the trust it borrows is usually wider than it should be.
paperless ngx v3 2 1: Flower conf passed only if present, mail fetch uses self expiring lock, ocrmypdf 17 12 ligature fix, Tantivy auto rebuild, anyio 4 14 2
paperless ngx v3 2 1: Flower conf flag fixed, self expiring mail fetch lock, ocrmypdf 17 12 ligature fix, automatic Tantivy index rebuild, anyio 4 14 2 bump
macOS Screen Sharing looks harmless until TCP 5900 is left open, then the macOS Screen Sharing authentication bypass turns a convenience into an entry point. I would not keep that service facing the internet, not unless you enjoy finding a miner where your desktop ought to be.
