GitLab CVE-2026-97229 is a CVSS 10.0 pre-auth RCE triggered by a crafted regular expression in a CI/CD config. The fix shipped in GitLab 19.4.2/19.3.5/19.2.8, but the real patch is in Ruby’s Onigmo regex engine - which GitLab applies only to its official packages. Upgrading GitLab on a custom Ruby build or image leaves you vulnerable, exactly as Alpine discovered on its own instance.…
Read more →On 26 Oct 2026 Tailscale confirmed that most reported Tailscale SSH issues are privilege-escalation problems; on 28 Oct the patched client v1.104.4 shipped and the TS-2026-014–017 advisory landed. A peer already allowed into a session could act beyond its user’s permissions - up to root-only Unix sockets. Here is what to check, upgrade and tighten.…
Read more →On 28 October 2026 Node.js 26 becomes Active LTS. It is the last LTS promotion under the old even/odd release model, and the first window where the new annual cadence (v27 Alpha starts the same day) shapes your version choice. v24 moved to Maintenance on 20 October; v22 reaches end-of-life in April 2027. Worst of all, the version to move to - 26.12.1 - is also the one that carries the October HIGH security fixes, including the Node2Shell Brotli RCE. Here’s how to plan the move on a self-hosted VPS, what breaks when you jump from 24/22, and the exact check-install-verify commands.…
Read more →CVE-2026-111497 (Node2Shell) is an out-of-bounds write in Google’s Brotli decoder, rated 9.2 on CVSS 4.0. It reaches any runtime that decodes untrusted Brotli - Node.js 22/24/26, Bun ≤1.4.3, Python brotli/brotlicffi, Envoy and Istio - from either side of an HTTP exchange. Imperva demonstrated unauthenticated remote code execution on the official Node.js 24.22.0 image. Here’s how to check what’s running on your VPS and upgrade safely.…
Read more →Two open-source, self-hosted PaaS platforms for your VPS, head to head: architecture, install, builds, scaling, pricing and licensing. The decision axis is not features - it’s how each one thinks about a cluster.…
Read more →The three most-picked entry clouds, head to head at the 1 vCPU / 1 GiB tier. Plan specs, network reach, developer experience, managed add-ons, and the honest verdict for each workload.…
Read more →A copy-pasteable walkthrough for running a Next.js app on your own VPS - Node, PM2, Nginx reverse proxy and free SSL, end to end, in about 15 minutes.…
Read more →On 21 Oct 2026 the Node.js project released security versions across all three supported lines - 26.12.1 (Current), 24.22.1 and 22.23.4 (LTS) - closing four HIGH CVEs, three of them remotely reachable by default, plus six more medium/low issues. Node 26 becomes Active LTS on 28 Oct. How to check your version and upgrade on a self-hosted VPS with nvm or a direct tarball, then restart cleanly under pm2.…
Read more →In mid-October 2026, several Show HN launches landed on the same axis: developers tired of PaaS bills that outgrow their projects, and lightweight deploy tools that don’t drag a Docker control panel onto the box. The recurring economics lesson: a handful of cheap VPSs beats a multi-provider PaaS stack on price - the missing piece was never the hardware, it’s the workflow. This article checks the actual prices on official pricing pages, walks through what a move really costs and what it gives up, and describes five tools for one-command deployment to your own VPS: Server Compass, OneDeploy, thevibehosting, Quicklify and docklift. This is deliberately not another Coolify-vs-Dokploy piece - we covered the heavy Docker-PaaS category there. Those platforms run a Docker stack on your server 24/7; October’s wave goes the other way - deploy to a plain Linux VPS without running a control plane at all. …
Read more →The two most common answers to ‘which VPS should I deploy to’ are now very different animals. Hetzner is cheaper per gigabyte and includes a huge amount of egress, but its cloud is currently hard to order and it has no managed databases or object storage in the US. DigitalOcean costs more per core but ships a finished managed ecosystem, US regions, and per-second billing. This page compares them on the tiers you actually deploy to and gives a verdict per workload.…
Read more →