Heads up for fellow Linux admins: CVE-2026-99999 (dubbed "PwnEscape") is out, and it is a nasty one (CVSS 9.3).

Despite being called a KVM escape, the actual bug lives in the host IPv4 networking stack. Untrusted CHECKSUM_PARTIAL offload metadata from a guest can overwrite already-validated packet headers during ip_do_fragment(), leaking host memory or allowing a guest-to-host escape.

Mainline patches landed Oct 14, and stable backports are out. Check your hypervisors and reboot!

https://pwn.ai/blog/pwnescape

#Linux #Kernel #SysAdmin #InfoSec #KVM #ITSEC #CVE

My old ThinkPad T480 is back in daily use, running FreeBSD 15.1. :freebsd:

Xfce, 5 GHz Wi-Fi, hardware video decoding in Firefox and Chromium (checked in the decoder, not just a capabilities page), a webcam that survived a 45-minute Zoom call, a Bluetooth speaker via virtual_oss, and SSH and Git signing from a smart card.

It's boring now. That's the point.

https://blog.hofstede.it/the-t480-is-back-my-freebsd-151-laptop-from-boot-to-browser/

#FreeBSD #ThinkPad #T480 #BSD #Xfce

Happy 30th Birthday, @kde! 🎂🎉

Three decades of free software, community power, and relentless innovation. Celebrating the milestone today by running KDE Plasma 6.8.0 on Fedora 44 - smooth, gorgeous, and rock-solid on Wayland.

Here’s to another 30 years of building one of the best computing experiences on the planet. Huge thanks to everyone who codes, designs, translates, and supports KDE! 💙

#KDE30 #KDE #KDEPlasma #Plasma6 #Linux #Fedora #OpenSource #FLOSS #Wayland #ThinkPad

New on the blog: ArtCraft is rebuilding Photoshop, Lightroom, Premiere, Word, Excel and more in Rust, with AI coding agents.

I tried it. PhotoCraft actually handled my video thumbnails, apps start in 1-2 seconds, and there are native #FreeBSD builds.

The more interesting part: GUI, CLI and agents drive the same engine. And when code gets cheap, verification becomes the bottleneck.

https://blog.hofstede.it/artcraft-rust-agent-desktop-apps/

#RustLang #OpenSource #AI #AIAgents #Linux #FOSS

Articles on my blog that were written with AI assistance now include a disclosure below the references section, with a link to my AI policy.

The ideas, technical content, and drafts are mine. AI helps me polish the English, and I review every edit.

https://blog.hofstede.it/ai-policy/

#Blogging #AI #Transparency #Writing

Good grief. There may actually be an outbreak of pneumonic plague in Russia.

I just went outside to check whether the DeLorean accidentally dropped me off in the wrong century.

Apparently it’s time to dig out the beaked plague-doctor masks, stuff them with herbs, and start protecting ourselves from the miasma again.

Absolutely normal events for 2026.

#PneumonicPlague #Russia #WrongCentury #DeLorean #PlagueDoctor #Miasma #TimelineError

New in FreeBSD Foundationals, part 4: rc.d, the service framework that fits in your head.

How /etc/rc orders your services, why rc.conf is just shell, what rc.subr gives you for free, and the daemon(8) pidfile trap that makes "service stop" quietly restart your process.

Then I audited my own production rc.d scripts. One of them reports "not running" while serving live Mastodon traffic.

https://blog.hofstede.it/freebsd-foundationals-rcd-the-service-framework-that-fits-in-your-head/

#FreeBSD #rcd #SysAdmin #Unix #RunBSD

New on the blog: Self-Hosted AI.

Qwen 3.8 27B on a rented RTX PRO 6000 Blackwell, one shell command, ~150 tokens per second. For most of my everyday coding, it is simply good enough now.

Also: what "self-hosted" really means on someone else's GPU. You swap trust in an AI vendor for trust in an infrastructure provider. Not zero trust, but a question I already know how to answer.

https://blog.hofstede.it/self-hosted-ai-qwen-38-on-a-rented-blackwell-at-150-tokens-per-second/

#SelfHosting #LLM #Qwen #OpenWeights #DataSovereignty

„Wie alt ist eigentlich die Jugendorganisation eurer Partei?“

Union: „Unser JU-Chef ist 34. Jung, dynamisch und bei den Erwachsenen darf er schon fast ohne Sitzkissen mit am Tisch sitzen.“

Wenn 34 bei euch noch als Nachwuchs gilt, versteht man zumindest plötzlich sehr viel.

#JU #CDUCSU #Nachwuchs #NieWiederCDU

For almost a year, my Ansible connection plugin for FreeBSD jails had a jail escape.

A symlink inside a jail, a root-owned mv on the host, and every file transfer could land wherever the jail wanted. Rejecting ".." didn't help at all.

Now it's CVE-2026-55074. Here's the bug, the fix, and what disclosing it looks like when the project has one maintainer.

https://blog.hofstede.it/my-ansible-plugin-had-a-jail-escape-cve-2026-55074/

#FreeBSD #Ansible #InfoSec #CVE #Jails #OpenSource #Security #SysAdmin

We had a big wave of automated Mastodon signups with very predictable usernames.

I first tried the sledgehammer approach and blocked known VPN ranges at the firewall.

It (partially) worked.

It also blocked legitimate ProtonVPN users. 😬

So I replaced that with a tiny custom Mastodon validator that rejects the actual abusive username pattern instead.

Much cleaner: block the abuse, not the transport.

How-to + code:
https://gist.github.com/chofstede/a422427570004719196cde948521dd04

#Mastodon #Mastoadmin #Fediverse #SysAdmin #Ruby #Rails #Security @tux @AlienJay @aping

Entire house felt like it moved. Small earthquake in southwest Germany 😳

#germany #earthquake

Bespoke is a programming language in which mutation requires an apology and deadlock is an Exemplary Stalemate of Mutual Deference.

The compiler is not angry. It is disappointed.

Source files end in .charming. Progress is subject to etiquette.

https://blog.hofstede.it/bespoke-a-programming-language-for-people-who-say-please/

#Programming #Esolang #ProgrammingLanguages #TechHumour #Humor #tech

I opened a €1,400 network switch.

Inside: one circuit board and some blinking lights.
No conveyor belts. No sorting bins. Not a single packet.

The packet lie goes deeper than you think:
https://netlie.netlify.app

#SysAdmin #Networking #IPv6 #TechHumor

There is something deeply satisfying about true data sovereignty.

No rate limits, no third-party APIs snooping on prompts, and zero cloud lock-in. Just raw self-hosted inference pulling 154 tok/s with an absurd 0.11s TTFT on local silicon.

Running Qwen with reasoning enabled, NVFP4 quantization on Blackwell, and SGLang speculative decoding. Crisp, private, and blazingly fast.

The future of AI belongs on your own hardware.

#SelfHosted #LocalAI #DataSovereignty #OpenSource #MachineLearning #SGLang #Blackwell #Linux #AI

Back home after spending a week in Spain. Wonderful scenery, lots of hiking and amazing food. What a beautiful place 🇪🇸

#spain #travelphotography #travel #photography

bhyve inside a jail sounds like a stunt. It isn’t.

FreeBSD has supported it since 12.0, and it turns the hypervisor into one more manageable jail: delegated ZFS, VNET, vm-bhyve, devfs rules and all.

Here is my complete production setup, including the security caveats

https://blog.hofstede.it/bhyve-inside-a-jail-the-freebsd-feature-nobody-uses/

#FreeBSD #bhyve #Jails #Virtualization #DevOps #Unix

So many beautiful corners to discover in Palma's historic center. Absolutely loving these winding alleys! 🌴🏛️ #Spain #travelphotography #wanderlust #urbanexploration #travelling

Git is great at storing dotfiles. It is less good at knowing where they belong, which permissions they need, or why a work laptop and a home server should differ.

Here is how I use chezmoi plus Git to manage fish, Neovim, SSH, GnuPG, Atuin and more. Including the “oops, I edited the live file” recovery workflow.

https://blog.hofstede.it/chezmoi-and-git-dotfiles-without-pretending-every-machine-is-the-same/

#chezmoi #dotfiles #git #linux #freebsd

New toy for FreeBSD folks who run Ansible: a become plugin for mdo(1), the mac_do(4) counterpart to sudo/doas.

The kernel decides whether the credential transition is allowed, so there is no password, no TTY, no doas.conf, and pipelining just works. Single file, BSD 2-Clause, tested against 15.1-RELEASE.

https://github.com/chofstede/ansible-become-mdo

Feedback welcome, especially from anyone already using mac_do in production.

#FreeBSD #Ansible #RunBSD #DevOps #Automation