Network Security
Authentik 2026 Security Response
Separate Authentik OAuth secret disclosure from inbound SAML account-mapping risks. Plan applicable updates, affected secret and session invalidation, and relying-application identity checks while retaining clean emergency administration.
Jellyfin Security: Treat Media as Untrusted Input
Contain untrusted Jellyfin media, preserve evidence, patch to the current stable release, restrict writable paths, validate clients, and recover without returning to a vulnerable version.
Tailscale Security Updates: Audit SSH, Serve, Funnel, and Services
Review Tailscale nodes and enabled features against current security bulletins rather than stopping at a historical fixed release. Assess SSH, Services, private Serve and public Funnel as separate exposure paths.
OpenWrt 24.10.8 and 25.12 Migration Runbook: Patch, Backup, Sysupgrade, and Recovery
An OpenWrt router upgrade runbook for patching exposed services, preserving config, checking device support, testing DHCP, Wi-Fi, DNS, and keeping recovery ready.
Keycloak 26.7.1 Security Response: Map the Fixes to the Features You Actually Use
Keycloak 26.7.1 includes many security fixes. This guide maps them to OIDC, SAML, FGAP, DCR, LDAP, metrics, and upgrade validation.
Bazarr 1.6.1 Security Response: Patch or Isolate, Rotate Keys, and Check for RCE
For affected Bazarr builds, isolate untrusted access, preserve evidence and verify a current fixed release. Review exposed secrets and logs before reopening access, distinguishing reasons to investigate from evidence that warrants rebuilding.
Portainer 2.44 Security and Bootstrap Tokens: Secure First Run and Existing Installs
A Portainer security runbook for first-run exposure, setup tokens, agent trust, endpoint permissions, backups, and management-plane isolation.
Entra Connect Sync: Verify Current Builds and Authentication Requirements
Assess Entra Connect servers against current version and authentication requirements, then verify actual synchronization and Health agents. Keep staging, active exports and recovery separate from assumptions about automatic upgrades.
Entra Password Reset: Registered Methods and the October 2026 Change
Check which registered methods users can actually use for Entra password reset, not merely populated directory contact fields. Plan ordinary-user reset tests and staffed recovery, with privileged accounts reviewed separately.
DNS Drift: Why Your Router, Browser, VPN, and Phone Use Different Resolvers
A detailed DNS audit for home networks and homelabs where router DHCP, browser Secure DNS, VPN clients, IPv6, and mobile Private DNS do not agree.