WirelessMoves – My Thoughts on the Evolution of Wireless, FOSS and the Past, Present and Future of Computing

Starlink Direct to Device – Q4 / 2026

At the end of 2024, I had a blog post on the first commercial launch of the Starlink direct to device service being launched in New Zealand with texting-only service and few technical details known. One and a half years later, and texting is not the only service anymore being available, and the service has launched in quite a number of countries such as the US, Canada, Japan, Chile and the Philippines. In Europe, the service is live in the Ukraine and in the UK. Also, a lot more is now known how the service actually works with what Starlink calls ‘unmodified’ mobile devices that support (terrestrial) LTE and know nothing of satellites. So let’s have a look at the current status in all these areas and document what works in September 2026.

MollySocket Air-Gap Configuration with Docker Compose

In the previous post I talked about the reasons behind why I decided to set up my own private and air-gaped MollySocket Unified Push Gateway for Molly, a fork of the Signal messaging app. The official documentation is a bit difficult to read and also offers no details on how to host MollySocket with Docker Compose. So I worked on this with an LLM a bit and here’s a straight forward version of how to install MollySocket with Docker Compose:

MollySocket For Using Signal on GrapheneOS without Google

OK, a bit of a cryptic headline, I admit, so here’s the full story: I use my Pixel 8 with GrapheneOS without any kind of Google infrastructure interaction. That limits the use of the ‘original’ Signal Messenger to Websocket notification for incoming messages. I don’t like that much, as this is quite battery intensive and keeps the cellular radio in active state for most of the time. Fortunately, there is a fork of the Signal messenger app called ‘Molly‘, which can use the UnifiedPush protocol as an alternative way to notify incoming messages to the app. In practice, this method of push delivery requires a proxy in the notification chain, as the Signal infrastructure does not natively support UnifiedPush. These proxies are called ‘MollySocket‘, and there are quite a number of public instances available. Unfortunately, all proxies I tried suffer from delay and reliability issues. I guess this is due to their popularity. But one can also host a private instance at home and this fortunately makes the use of UnifiedPush for Signal/Molly rock steady.

EarlyOOM in Ubuntu 26.04

One user in our household has a particular approach to computing on the notebook: Never close anything. No apps, no windows, no browser tabs. Over time, this fills up memory, not only because of the rising number of windows, but because of the many memory holes of browsers that just take up more and more RAM. The unfortunate consequence: At some point, the OS can’t get any more memory, swap is full and the system crawls to a standstill. Unfortunately, Linux is not very good at terminating programs when push comes to shove. Many years ago, I found EarlyOOM (Early Out of Memory), a great program that observes available memory and terminates tasks before the Linux kernel gets in trouble. It works like a charm. For the migration to Ubuntu 26.04, I now wanted to see if the Linux kernel still behaves this badly when running out of RAM and if EarlyOOM would still work.

Prosody Install Fixes When Moving from Ubuntu 24.04 to 26.04

Canonical has opened the gates to move from Ubuntu 24.04 to 26.04 so I am in the process to migrate my desktops and virtual machines to the latest LTS version. This has been a smooth process so far, until I got to the VM hosting one of my Prosody XMPP servers. While the update from 22.04 to 24.04 two years ago was smooth, I ended up with a broken install after the upgrade this time. I’d say this is mostly the LTS upgrade process fault and not Prosody’s. To make a long story short, two things broke during the upgrade:

The apt repository files are modified and bricked by the Ubuntu Upgrade process, that needs to be fixed by hand
The Lua installation (5.2) is not working any more after Ubuntu 24.04 to 26.04 despite still being there. Let’s use the opportunity to install lua5.4 and make Prosody use it. There is ‘sort of’ a hint about this here.

Severity vs. Exploitability

This week’s most important technical learning for me (so far) was that there is a big difference between the severity of a vulnerability and its exploitability. The general press often seems to make no difference between the two, which leads to a lot of initial hysteria and often to a subsequent non-event, which is then, of course, not reported. In the past two weeks, several vulnerabilities were published with a high severity score, which caught a lot of media attention. But their exploitability ‘seems’ to have been nowhere near what their severity score suggested.

Let’s have a look at a rather good example, CVE-2026-99999, a vulnerability much hyped for a day because of its severity rating and potential impact if it could be easily exploited remotely. After all, the vulnerability would enable a Virtual Machine escape and host compromise. Sounds bad, doesn’t it?

How to Make Nextcloud AIO Un-Reachable While Updating

Last week’s PHP exploit scare left the world scrambling to update their systems. Nothing much happened afterwards, but I preferred to err on the cautious side and decided to shutdown my servers and only start them again once the PHP parts were fully patched. This worked great for all of my servers except for one: A Nextcloud AIO (all in one) installation. I tried a lot but I couldn’t find a way to stop all containers, update them, and only then start them again. While it’s easy to stop the production containers, I couldn’t find a way to update the installation without AIO’s master container running. This is bad, as the master container has an administration web frontend that probably uses PHP, too. Hence, no way I would connect this VM to the Internet while patching. But finally, I found something that helped.

The Week of ‘Critical’ PHP Exploits – And Nothing Happened – Yet

I’m temped to write a short note here because something good and odd happened that I did not expect. Last Wednesday (21. October 2026), two critical PHP vulnerabilities were disclosed (CVE-2026-109618 and 619). Stern warnings were issued that patches for them should be applied as quickly as possible. The reason given was that it seemed likely that it would only take a short while until a way would be found to use them for remote code execution (RCE) without login or any other previous interaction with the target. It sounded really bad.

MeshCore – Part 4: Observing the Hops

After looking at the direct range between two MeshCore devices in part 3 of this series, another exciting aspect of MeshCore is how messages are forwarded between repeaters in the network. In the smartphone app, one can see the list of all repeaters that have forwarded a message, as each message does not only contain the content, but the chain of repeater IDs it has gone through. The screenshot on the left is a good example of a relatively direct path.

Replacing Logitech M650 Mouse Buttons

When it comes to input devices, I do have my preferences. For many years, I’ve been using Logitech M650 mice for many reasons, the main one being is that they have silent keys. The main drawback of them, however: The buttons wear out over time. Very irritating. My fix so far: Buy a new mouse. But these mice are expensive, so I was wondering if one could perhaps exchange the switches used below the mouse buttons. And indeed, this is possible and it costs almost nothing!