root@labs:~$ make something

What we build, and what we think about it.

Projects are the technical record: what we built, how, what we'd do differently. The blog is everything else, posted when there's something worth saying.

cd /projects cat blog/latest
root@labs:~$ ./status.sh
✓ site rebuilt and online
✓ latest post: Two critical RCEs in PHP, and why your version number is lying to you
… in progress: The Synology (RS815+)
✓ forum: Home networking: what’s actually running your network?

recent-entries

synology The Synology (RS815+) Years of runtime, relearned every time DSM changes. ● active media-server Home Media Server A NAS, a media server, and an automation stack that never really finishes. ● active homelab Rebuilding rootlabs.us New AWS home, Caddy, PHP, WordPress, and the redesign you're looking at. ● active 3d-printing The print lab FDM and resin printing: functional parts, jigs, and beautiful failures. ○ ongoing electronics Smart home, the hard way Automating the house one stubborn device at a time. ○ ongoing

readme

Root Labs is where the fun stuff goes. A lab for after-hours engineering: homelab, 3D printing, electronics, software, and whatever we get our hands on next. No clients, no tickets, no invoices. Projects, experiments, and honest write-ups of both.

blog --latest

2026-10-21 homelab Two critical RCEs in PHP, and why your version number is lying to you Two unauthenticated RCEs in PHP, both CVSS 9.2, patched October 21. If php -v says 8.3.6 and the advisory says… read → 2026-10-21 news MyRGB 0.2.0: we built the RGB app we wanted MyRGB 0.2.0 beta is out. One app that lights every brand on your desk as one canvas, so you can… read → 2026-10-18 media-server Plex patched this in August. Exploit code dropped Friday and 49,000 servers were still open. Exploit code for a four-bug chain in Plex Media Server went public on October 16 and attackers were using it… read → 2026-10-16 news 816 billion open-weight parameters, and a terabyte of RAM to run them Meta released 816 billion parameters of open weights on October 15. Running it locally takes two Mac Studios and a… read → 2026-10-13 homelab A CVSS 10 in self-managed GitLab, and the bill that comes with owning your stack A CVSS 10.0 integer overflow in GitLabs CI/CD regex compiler lets an attacker run code on a self-managed server. Fixed… read →