Martin – WirelessMoves

Prosody Install Fixes When Moving from Ubuntu 24.04 to 26.04

Canonical has opened the gates to move from Ubuntu 24.04 to 26.04 so I am in the process to migrate my desktops and virtual machines to the latest LTS version. This has been a smooth process so far, until I got to the VM hosting one of my Prosody XMPP servers. While the update from 22.04 to 24.04 two years ago was smooth, I ended up with a broken install after the upgrade this time. I’d say this is mostly the LTS upgrade process fault and not Prosody’s. To make a long story short, two things broke during the upgrade:

The apt repository files are modified and bricked by the Ubuntu Upgrade process, that needs to be fixed by hand
The Lua installation (5.2) is not working any more after Ubuntu 24.04 to 26.04 despite still being there. Let’s use the opportunity to install lua5.4 and make Prosody use it. There is ‘sort of’ a hint about this here.

Severity vs. Exploitability

This week’s most important technical learning for me (so far) was that there is a big difference between the severity of a vulnerability and its exploitability. The general press often seems to make no difference between the two, which leads to a lot of initial hysteria and often to a subsequent non-event, which is then, of course, not reported. In the past two weeks, several vulnerabilities were published with a high severity score, which caught a lot of media attention. But their exploitability ‘seems’ to have been nowhere near what their severity score suggested.

Let’s have a look at a rather good example, CVE-2026-99999, a vulnerability much hyped for a day because of its severity rating and potential impact if it could be easily exploited remotely. After all, the vulnerability would enable a Virtual Machine escape and host compromise. Sounds bad, doesn’t it?

How to Make Nextcloud AIO Un-Reachable While Updating

Last week’s PHP exploit scare left the world scrambling to update their systems. Nothing much happened afterwards, but I preferred to err on the cautious side and decided to shutdown my servers and only start them again once the PHP parts were fully patched. This worked great for all of my servers except for one: A Nextcloud AIO (all in one) installation. I tried a lot but I couldn’t find a way to stop all containers, update them, and only then start them again. While it’s easy to stop the production containers, I couldn’t find a way to update the installation without AIO’s master container running. This is bad, as the master container has an administration web frontend that probably uses PHP, too. Hence, no way I would connect this VM to the Internet while patching. But finally, I found something that helped.

The Week of ‘Critical’ PHP Exploits – And Nothing Happened – Yet

I’m temped to write a short note here because something good and odd happened that I did not expect. Last Wednesday (21. October 2026), two critical PHP vulnerabilities were disclosed (CVE-2026-109618 and 619). Stern warnings were issued that patches for them should be applied as quickly as possible. The reason given was that it seemed likely that it would only take a short while until a way would be found to use them for remote code execution (RCE) without login or any other previous interaction with the target. It sounded really bad.

MeshCore – Part 4: Observing the Hops

After looking at the direct range between two MeshCore devices in part 3 of this series, another exciting aspect of MeshCore is how messages are forwarded between repeaters in the network. In the smartphone app, one can see the list of all repeaters that have forwarded a message, as each message does not only contain the content, but the chain of repeater IDs it has gone through. The screenshot on the left is a good example of a relatively direct path.

Replacing Logitech M650 Mouse Buttons

When it comes to input devices, I do have my preferences. For many years, I’ve been using Logitech M650 mice for many reasons, the main one being is that they have silent keys. The main drawback of them, however: The buttons wear out over time. Very irritating. My fix so far: Buy a new mouse. But these mice are expensive, so I was wondering if one could perhaps exchange the switches used below the mouse buttons. And indeed, this is possible and it costs almost nothing!

Wireguard as Client on Ubuntu 26.04

Some things take a bit of time. 2 years ago, I started my first experiments to replace my OpenVPN server instances with a dockerized Wireguard sever. It worked, but Ubuntu 22.04 I used at the time did not have a built-in GUI plugin for it. As I skipped Ubuntu 24.04, I had to wait for 26.04. With this in place now, I was wondering how well Wireguard runs on this platform. The quick answer. Rock stable!

MeshCore – Part 3: Range

One of the things that surprised me quite a bit when I started experimenting with MeshCore is its range. The technology only sends small data bursts and hence can focus a lot of signal energy into the transmission, but still, I could hardly believe the ranges I got.

MeshCore – Part 2: Web Serial For Flashing

After having had a first look at MeshCore in the previous post, here’s a follow-up on how to actually flash software to devices. This used to be a bit tricky, as flashing devices over USB in the past typically required downloading a binary for the device and an app to flash the device from a PC or notebook. Then, Web Serial for web browsers came along. Until now, I’ve never used it and always preferred the manual way. MeshCore offered the perfect opportunity to give Web Serial in the web browser a try and learn. I was expecting a bit of resistance and a steep learning curve, and was surprised that what I got instead was an easy process and a working device in 2 minutes.

MeshCore – Part 1: What is This?

Recently, I heard the term ‘MeshCore‘ a few times from people who were quite enthusiastic about this rising star in the mesh radio networking domain. After listening to a talk about it (in German), I decided that I wanted to try it out as well. A device costs around 50 euros, so I ordered a few. Just out of interest, without a particular use case in mind (yet). So what is this ‘MeshCore’ then?