Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
Self hosting is getting really exhausting lately… Maybe I will just gate everything behind a VPN and stop sharing my services with relatives :/
Yeah, I’m starting to think that a tunnel at the router level with family is a preferred approach. I dread the setup time, but it sure lowers the attack surface.
If you do the heavy lifting with external libraries in python, you are already running C code.
VPN enrollment is scanning a qr code nowadays. Or site2site, with a "plug this box into your network’ really shouldn’t be an obstacle in the year of the lord 2026
Putting everything behind a VPN is useless if i give people who routinely click phishing links (then ask me for help when/if they realize their mistake, that’s how I know) access to said VPN
Not if your threat model is “bots that scan the internet for vulnerable installations of X”.
A lot of these bot requests come from what seems to be compromised hosts turned into scanners and residential proxies.
Nah just vibe code the stuff you host in Rust. These are all memory safety bugs.
My exception is Home Assistant which is unfortunately Python 🤢 but it’s not exposed to the internet.
I find it funny you’re hating on python right after praising vibe coded slop :D
Or maybe that was just sarcasm
I’m not praising vibe coded slop. Vibe coding with the latest models doesn’t produce slop anymore. And I’m not really praising that - just saying that it’s true.
99 times out of 100 a well used open source program written in any language is going to be more secure than something vibe coded in rust. Sure you wont get memory bugs (probably, if you’re just vibing it how do you know its not using unsafe rust?), but it is vastly more likely to just contain regular logic bugs.
