93
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 22 Oct 2026
93 points (97.0% liked)
Selfhosted
63211 readers
490 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil.
-
No spam.
-
Posts are to be related to self-hosting.
-
Don't duplicate the full text of your blog or readme if you're providing a link.
-
Submission headline should match the article title.
-
No trolling.
-
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
-
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 3 years ago
MODERATORS
It's really not the publicly disclosed vulnerabilities you need to worry about. Most of those vulnerabilities have existed for years - the recent php thing is supposedly 12 years old. Maybe someone's been out there exploiting it for 12 years.
The people who have sought and exploited vulnerabilities since computers went online don't disclose what they find. They are the people who should be most worried about AI-assisted vulnerability research, because it directly attacks their business model.
10000% correct! I bet the NSA or KGB has had that PHP exploit for close to a decade and they are gutted its finally been patched! There are probably an infinite number of vulnerabilities in currently running servers and clients, a few 100 will already be known and being quietly exploited. Yes, ai will find some completely unknown ones for malicious actors, but it will also find those same ones for cybersec bods, so effectively cancel each other out.
Do security companies like cloudflare go back and look for past exploitation of vulnerabilities that were recently found by the public? I can't think of any "we found this new vuln and turns out someone has been exploiting it for years" stories.
Maybe not, but maybe, just maybe, the people with these exploits aren't running round attacking Joe bloggs personal photo album server to steal some photos, but in fact are only using the exploit very carefully and sparingly so as not to be detected, and only targeting high value and highly confidential services, where even if they were hacked or a specific exploit was deployed, either are too big to notice, or to proud to divulge the fact they lost some data 🤷