EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Aug 12·5 min read
My Homelab Got Hacked - A Postmortem
TL;DR
A personal homelab was compromised due to a Remote Code Execution (RCE) vulnerability in Forgejo, identified as CVE-2026-60004. The incident highlighted the importance of securing user sign-up settings.
✦ Why It Matters
Review and tighten user sign-up settings in your applications to prevent unauthorized access.
Key Takeaways
- Regularly update software to avoid known vulnerabilities.
- Disable open sign-ups to prevent unauthorized account creation.
- Implement strict network access controls for containers.
- Utilize daily backups to quickly recover from incidents.
How It Works
The exploit leveraged a vulnerability in the diffpatch endpoint of Gitea, allowing attackers to execute malicious Git hooks. By creating a new user and pushing a repository with a harmful script, the attacker triggered the RCE, leading to the installation of crypto-mining software.