If you have anything with SSH exposed that comes from Docker, alpine, or even generally you should double check you aren't vulnerable:
Disclosure first: I'm the founder of a technical due diligence tool that reads git histories, which is how this list came about. You don't need it for anything here, and there's no link to it.
Across the 1,577 public projects it has read, it flagged apps that report home by default. These 14 were each checked against the project's own code, and all were still on by default in the latest code on 5 November.
| App | Reports to | Turn it off |
|---|---|---|
| Grafana | stats.grafana.org | reporting_enabled = false in [analytics] |
| Jenkins | usage.jenkins.io, from the admin's browser | -Dhudson.model.UsageStatistics.disabled=true |
| NocoDB | telemetry.nocodb.com | NC_DISABLE_TELE=true |
| Plane | telemetry.plane.so | the telemetry box at instance setup (is_telemetry_enabled) |
| Directus | telemetry.directus.io | TELEMETRY=false |
| SeaweedFS | telemetry.seaweedfs.com | -telemetry=false on the master |
| Leantime | telemetry.leantime.io | LEAN_ALLOW_TELEMETRY=false |
| OpnForm | telemetry.opnform.com | OPNFORM_ANONYMOUS_TELEMETRY_DISABLED=true |
| Checkmate | checkmate-telemetry.bluewave-labs.workers.dev | TELEMETRY_ENABLED=false |
| Onyx | telemetry.onyx.app | DISABLE_TELEMETRY=true |
| Coder | telemetry.coder.com | CODER_TELEMETRY_ENABLE=false |
| Qdrant | telemetry.qdrant.io | telemetry_disabled: true |
| Saleor | usage-telemetry.saleor.io | SEND_USAGE_TELEMETRY=False |
| Payload | telemetry.payloadcms.com | telemetry: false in the config |
Three that look as if they belong here and don't:
This isn't a complaint. Several describe what they send as anonymous, and I haven't judged what each one sends, only that it's on until you say otherwise. The list is what's in my library, not every app. If I've got one wrong, tell me and I'll fix it.
If you'd like analysis and might want to use my tool, DM me.
 | Hey all! Greetings from the web page change detection and notifications project over at https://github.com/dgtlmoon/changedetection.io It's been a long long time! In summary basically huge UI overhaul, much friendlier, along with all the modern MCP/AI integration and ofcourse lots of bug fixes and improvements. I havent made any posts on r/selfhosted from a long long time! haha.. more details follow..
Much love! changedetection.io team. [link] [comments] |
Heads up if you run Ubuntu or Debian servers. A new APT flaw was published on Nov 4, and how you install the fix matters.
CVE-2026-109518 is in APT's HTTP backend, so it affects apt, apt-get and aptitude. Ubuntu rates it High (CVSS 4.0 score 7.7). An attacker who can tamper with your HTTP traffic, or a malicious mirror, can get APT to install a package that failed signature verification. Package scripts run as root, so that means root on the box. It needs a retried download to work. Neither Ubuntu nor Debian says it is being exploited.
Ubuntu's recommended update turns retries off while you patch:
sudo apt update && sudo apt upgrade -o Acquire::Retries=0
If a full upgrade isn't possible right now:
sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'
To check your version:
apt list --installed '?source-package(^apt$)'
Fixed versions:
- Ubuntu 22.04: 2.4.15ubuntu0.1
- Ubuntu 24.04: 2.8.4ubuntu0.1
- Ubuntu 26.04: 3.2.1ubuntu0.1
- Debian trixie: 3.0.4 (the advisory only names trixie, so check the Debian tracker for other releases)
Other things Ubuntu notes: HTTPS protects against the on-path case, but some community and country mirrors don't support it. Unattended-upgrades applies the patch within 24 hours if you have it enabled.
Question for people running apt-cacher-ng or a local mirror: is the traffic between your clients and the cache plain HTTP, and are you changing anything because of this? Neither advisory covers that setup.
Sources:
- Ubuntu: https://ubuntu.com/blog/apt-vulnerability-fixes-available
- Debian DSA 6607-1: https://lists.debian.org/debian-security-announce/2026/msg00526.html
- Debian tracker: https://security-tracker.debian.org/tracker/apt
(Drafted with AI help. The facts are from the pages linked above.)
Login