Welp. My Forgejo instance got popped with an RCE two days ago by CVE-2026-60004. Luckily, I noticed the following morning and had the day free to figure out what happened. Let’s dive in!
As a homelab enthusiast, I found this a very interesting post. Here are my take aways from the post that I’m implementing myself:
- Miner detection. I’ve updated monitoring rules to now watch the CPU on my hosts. If the same thing happened to me I would not have been alerted at all as I’m doing simple up / down monitoring. Fixed.
- Access logging. I turned on access logging for my homelab Caddy instances.
- Log retention. I have increased the amount and retention of my logging. The hope is this will help me reconstruct what happened after a breach.
- Logs offsite. The VPS access logs now ride along with the normal backup process, which runs hourly. The homelab side still only gets caught by the weekly VM backup, so that’s next.
- Closed an open signup. My webtrees instance (genealogy) had self registration enabled, which is the same door this guy got hit through. Oops. Fixed.
- Built a tool.
log-inventory.sh, so “could I actually reconstruct what happened” is a command I run instead of a thing I assume.
I hate providers not offering me a latest tag. Is there any valid reason not to do that?
Even worse, super stupid version tags such as MinIO is using:
RELEASE.2025-09-07T16-13-09Z-cpuv1(I wish I made that up)My guess, auto updates for major versions is not good practice. Installations potentially corrupt and users come screaming to the project maintainers instead of searching the blame by themselfe.
forgejo defined the lifecycle for every version so just add a calendar entry for when the supports runs out and then update the 3 characters in the docker compose file.
I can get that and I also prefer sticking to major versions. However, I am chaotic and easily have 50 different docker images, checking all the release cycle of all of those gets exhausting.
I believe I need to start generating notifications if a tag has not received an update for more than 30d.