A copy-pasteable walkthrough for running a Laravel app on your own VPS - Nginx, PHP-FPM, a database, Composer, .env, queue workers and cron, end to end, with a Docker Compose alternative.…
Read more →The Next.js security release is out. Vercel shipped v16.4.5 (Active LTS) and v15.5.29 (Maintenance LTS) on November 3, 2026, closing seven advisories: one high severity and six medium. If you self-host, the patched code only reaches production when you update the dependency, rebuild the standalone artifact, and restart the process. This guide maps all seven advisories to their affected surfaces, calls out the ones that matter most for a self-hosted stack in front of nginx, and walks through the exact update sequence for a standalone build under PM2.…
Read more →CVE-2026-111497 (Node2Shell) is an out-of-bounds write in Google’s Brotli decoder, rated 9.2 on CVSS 4.0. It reaches any runtime that decodes untrusted Brotli - Node.js 22/24/26, Bun ≤1.4.3, Python brotli/brotlicffi, Envoy and Istio - from either side of an HTTP exchange. Imperva demonstrated unauthenticated remote code execution on the official Node.js 24.22.0 image. Here’s how to check what’s running on your VPS and upgrade safely.…
Read more →A copy-pasteable walkthrough for running a Next.js app on your own VPS - Node, PM2, Nginx reverse proxy and free SSL, end to end, in about 15 minutes.…
Read more →Nginx 1.31.7 moved the open-source geoip modules from the retired GeoLite .dat format to native MaxMind DB (MMDB) support. Here is the 2026 way to geo-block and geo-route by country on stock nginx: geoip_country + GeoLite2-Country.mmdb, map and if for the block, geo-aware rate limiting, and the http and stream modules side by side.…
Read more →A straight comparison of Caddy and Nginx for self-hosting: when Caddy’s automatic HTTPS saves you real time, when you still need Nginx, and how to pick.…
Read more →nginx 1.31.7 (mainline) and 1.30.6 (stable) fix five medium-severity CVEs shipped 14 Oct 2026: alias+rewrite buffer overflow, script-expression overflow, HTTP/3 body injection, TLS session-ticket forgery, and an AIO/SSI use-after-free. How to tell which of your configs are in scope, and how to upgrade.…
Read more →Three working layers to cut AI-scraper and bot-flood traffic on a VPS: robots.txt for the cooperative crawlers, an nginx map that returns 444 on known AI user agents, and limit_req for everything that spoofs or skips a user agent.…
Read more →A decision guide and working configs for running your own HTTP tunnel on a VPS - SSH reverse tunnels with autossh, self-hosted relays (frp, rathole, bore, chisel), and what Cloudflare Tunnel and Tailscale Funnel still do for you.…
Read more →nginx 1.31.6 (and 1.30.5) fix CVE-2026-90439, a heap buffer overflow in the HTTP/3 module that fires when running OpenSSL 3.5.0 and earlier. How to tell if your reverse proxy is affected, and how to upgrade.…
Read more →