BMC Vulnerabilities, Nextcloud Development, and AI Governance

Homelab Highlights for 2026-08-05: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

News Roundup

App developer workshop: building your first Nextcloud app (Aug 12)

Nextcloud is hosting a free virtual workshop to bridge the gap between their documentation and building a first app. It covers the app structure, public APIs versus internal code, and common pitfalls.

Why it matters: This is a practical entry point for self-hosters who want to customize or extend their Nextcloud instances but have found the initial learning curve daunting.

Source: Nextcloud Community

Governance Is a Developer Experience Problem

A blog post argues that effective AI governance is less about restrictive security and more about creating clear, trusted boundaries that enable developers to safely adopt and scale agentic workflows.

Why it matters: It reframes a common infrastructure challenge for those experimenting with local AI agents, suggesting that clear operational guardrails are key to moving from limited experiments to productive use.

Source: Docker

Ring upgraded its peephole doorbell camera to 2K

Ring has released a new version of its Peephole Cam, featuring 2K video, a sleeker design, and easy installation that replaces a standard door peephole without drilling.

Why it matters: For homelab enthusiasts interested in smart home tech, this represents an update to a specific, drill-free hardware category that integrates with broader ecosystem platforms.

Source: The Verge

Security Update

Metabase has published a security update notice.

Why it matters: Metabase is a popular open-source business intelligence and data visualization tool used in many self-hosted environments, making its security advisories directly relevant for lab operators.

Source: Metabase

Tool & Software Highlight: Thousands of servers can be backdoored by exploiting buggy motherboard controllers

Research presented at Black Hat reveals critical vulnerabilities in baseboard management controllers from major server manufacturers like HPE, Dell, and Supermicro. These BMCs, which provide out-of-band management, present a pervasive and often unpatched attack surface.

Why it matters: For anyone running enterprise-grade hardware in a homelab, this is a direct security risk. The vulnerabilities allow for remote backdoor access, persistence even after OS reinstallation, and affect a significant portion of internet-exposed devices.

Source: Ars Technica

One Thing to Try

Review the baseboard management controller settings on any enterprise servers in your lab. Ensure it’s on an isolated management network, update the firmware to the latest version, and replace any default or weak credentials with long, unique passwords.

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

Host A: [thoughtful] So, Black Hat this week had some pretty stark research on a classic homelab attack surface. HD Moore from runZero presented findings showing thousands of servers can be backdoored through vulnerabilities in their baseboard management controllers.

Host B: Right, BMCs—those little embedded computers on server motherboards that handle out-of-band management. They’re your lifeline when the main system is down, but Moore’s calling them a pervasive, under-monitored, under-patched parallel attack surface.

Host A: His team scanned over 86,000 internet-exposed BMCs and found more than half had critical vulnerabilities. Some of these bugs, like CVE-2013-4786 which lets attackers crack passwords offline, have been known since 2013.

Host B: And this isn’t just a scan result—they point to real-world implants like ILObleed from 2021, where wiper firmware infected HPE servers through the BMC. Even swapping hard drives wouldn’t remove it because the implant lived in the controller itself.

Host A: The presentation broke it down into seven bug classes affecting HPE, Supermicro, Dell, and others. Things like authentication bypasses in the IPMI handshake, predictable session tokens you can guess to hijack a live session, and firmware that doesn’t properly enforce integrity checks.

Host B: One nasty class involves using secrets recoverable from public firmware images as live credentials. Another is default or factory-random passwords that can be cracked because the hash is disclosed through that old CVE.

Host A: Moore released an open source tool called OOBscan to check your own gear. Beyond that, the recommendations are straightforward but critical: use long, unique credentials, disable IPMI if you don’t need it, and isolate each BMC on its own network segment.

Host B: [conversational] For homelabs running any enterprise hardware, this is a good reminder to check your BMC firmware version and make sure that management interface isn’t accidentally exposed. The research showed some had been sitting online for years with default creds still active.

Host A: Shifting gears to something more constructive—Nextcloud announced a developer workshop for next week. Anna Larch from their DevRel team is running a free, recorded virtual session on building your first Nextcloud app.

Host B: It’s on August 12th, and it’s specifically aimed at the gap between their documentation and actually knowing where to start. The docs are decent once you’re oriented, but if you’re not, it’s hard to tell which parts matter.

Host A: They’ll cover the request-response flow, the crucial difference between OCP and OC namespaces—OCP is the public API you build against, OC is internal and touching it breaks on upgrades—plus entities, mappers, migrations, and how to listen for events from other apps.

Host B: They’re pulling examples from real apps like Talk and Dashboard, and they’re collecting questions from the community forum thread in advance for the live Q&A. Registration is open through their community site.

Host A: [lighter] And one more note from the feeds—Docker published a blog post framing AI governance as a developer experience problem. The argument is that clear boundaries around where agents run and what they can access create the trust needed for large-scale adoption, which is an interesting lens for anyone experimenting with local AI agents in their lab.

Host B: Let’s dig into that OOBscan tool HD Moore mentioned. It’s an open source vulnerability scanner written in Go, specifically for BMCs, and it’s up on GitHub under the runZero organization.

Host A: What’s useful is it’s designed to check for the growing list of vulnerabilities his research cataloged. Since BMCs are often missed by general vulnerability scans, having a dedicated tool that understands IPMI and the various vendor implementations makes a lot of sense.

Host B: You’d run it against your server IP ranges to see which BMCs have which specific issues. It supports outputting JSON so you can pipe results into your existing monitoring or ticketing system.

Host A: It’s not just checking for one CVE. Moore found more than a dozen new vulnerabilities across multiple vendors, plus older ones that never got patched in the field. So a scanner that stays current with that research has real operational value.

Host B: [practical] For a homelab perspective, if you’re running a server with an HPE iLO, Dell iDRAC, or Supermicro IPMI, this gives you a way to check it yourself rather than waiting for a vendor advisory. The scanner runs locally, so you’re not sending credentials to a third-party service.

Host A: Moore also pointed out that ‘security through obscurity’ tactics, like running the service on a non-standard port, don’t really help anymore. Attackers are scanning everything. Real security comes from strong authentication, firmware updates, and proper network segmentation—putting that BMC interface on a dedicated management VLAN.

Host B: The tool’s architecture is designed to be respectful. It uses Go’s concurrency for speed but has timeouts and rate limiting to avoid overwhelming the target BMCs during a scan. You don’t want to accidentally DOS your own equipment while checking its security.

Host A: There’s also a dry-run mode that shows you what it would check without sending any probes, which is great for understanding its behavior first. And for most checks, you don’t even need credentials—it identifies vulnerabilities from banner information, response patterns, and protocol behaviors.

Host A: Our community highlight goes to that Nextcloud developer workshop. What stands out is how directly it’s responding to a pain point the community has been talking about in their forums.

Host B: Exactly. The workshop description openly says the docs assume you already know which parts matter. If you don’t, it’s hard to tell where to start. Several people had posted about getting stuck trying to build even simple apps because the initial learning curve was too steep.

Host A: So Anna Larch is bridging that gap with concrete examples from existing, well-known apps like Talk and Dashboard. She’ll show where your code lives, what the platform already handles for you, and how to avoid common pitfalls that cause apps to break on the next Nextcloud upgrade.

Host B: [curious] They’re also collecting questions from the community thread beforehand to answer during the live Q&A. The thread already has specific questions about things like database migration strategies and how to handle user permissions properly in an app.

Host A: For someone who’s been running Nextcloud and has thought about writing a custom app for their needs but felt intimidated, this workshop could be the perfect push. And since it’s recorded, even if you can’t make the live session, you get the replay to work through later.

Host B: It’s a good example of how mature open source projects can grow their contributor base—not just by writing more documentation, but by creating these guided, interactive entry points for people who learn better that way.

Host A: One community member mentioned they’d been running Nextcloud for three years but never felt confident enough to modify or extend it. This workshop structure, with clear examples and advance Q&A, feels designed for exactly that experience level.

Host B: [with a small lift] The workshop materials themselves are being developed openly too. Anna shared a draft agenda in the forum and asked for feedback. Community suggestions, like adding a section on debugging common errors and testing across different Nextcloud versions, actually made it into the final schedule.

Host A: That collaborative approach builds trust. When people see their input shaping the content, it turns the workshop from a lecture into a kind of community co-creation, which is how the healthiest open source projects operate.

Host B: And there’s immediate practical value—developers who go through the workshop will end up with a working app skeleton they can immediately adapt for their own ideas. That tangible outcome really matters when you’re asking people to invest a couple of hours.

Host B: Here’s a quick, actionable tip from today’s stories. If you have servers with BMCs, take a few minutes to verify that the management interface is on a separate, isolated VLAN or at least heavily firewalled from general internet access.

Host A: And while you’re there, update those BMC credentials if it’s been a while. The research shows default or factory-randomized passwords are often crackable offline because the hash can be exposed. Long, unique passwords generated by a manager matter more here than you might think.

Host B: [skeptical] Also, check your BMC firmware version against the vendor’s latest. A huge number of the vulnerabilities Moore found were actually patched years ago in newer firmware, but systems never got updated because of that ‘if it ain’t broke’ mentality. Schedule those updates during a maintenance window.

Host A: For Nextcloud users, even if you’re not ready to develop right now, bookmark that workshop page. Having the recording on hand means you can reference it the moment you do have an app idea. The app scaffold generator they cover alone could save you hours of initial setup time.

Host A: That’s Homelab Highlights for Wednesday. Until next time, happy hosting!