Hi everyone! Some promises age like good wine. Others age like milk forgotten in a hot car. A few days ago I opened Package Center, saw a fresh Container Manager update waiting for me and, for one second, just one, I believed. Then I read the version number. Same engine, same silence, same story. And that was only the beginning of these two weeks. Synology finally revealed what was hiding behind the “undisclosed details” of DSM 7.4.1-90080 Update 1, and it is not a small list: 25 vulnerabilities, eight of them rated Important. The quiet exodus from Portainer has become impossible to ignore. And with Black Friday knocking at the door, YouTube is filling up with “honest reviews” that are anything but honest. Grab a coffee, sit comfortably. This roundup is a bit more personal than usual.
First of all, the usual disclaimer: this is still the same no-fluff roundup. Real updates, verified at the source, written for people running Synology, UGREEN, Asustor and plain Docker on home NAS boxes. A small reminder about the Roundup schedule. The Roundups are posted twice a month: one in the middle of the month and one at the end. From 2027 they will be posted weekly. This way I have a bit more time to test properly instead of rushing.
🐳Container Manager 24.0.2-1707: A New Update, The Same Old Engine
Synology has published Container Manager 24.0.2-1707. The official release notes, dated November 5, 2026, contain exactly one fix: “Fixed an issue where the version of containerized services in Web Station might not be updated.” There is also a limitation worth knowing. After this update, creating certain containerized web services in Web Station (WordPress, PHP, Node.js, Python, Plex from linuxserver, Joomla, PostgreSQL and others) only supports later versions of the container images. Your existing services keep running on their current images, so nothing breaks overnight.
Now the part that really matters. Which Docker Engine is inside? Still Docker 24.0.2. The same engine that arrived with Container Manager 24.0.2-1535 in February 2025, and an engine that Docker itself released back in May 2023. Since then Synology has shipped seven builds of Container Manager (1535, 1542, 1543, 1606, 1630, 1706 and now 1707), and in all of them the only number that moves is the one at the end. Meanwhile the upstream Docker Engine is at version 29.9.3, released on November 3, 2026, with 29.10 already in release candidate. We are talking about five major versions behind.
And please, don’t tell me that a NAS vendor can’t do better. The others have been shipping a modern engine for a long time, as I keep tracking in my article Docker Engine: Synology, TerraMaster, UGREEN, ASUSTOR, QNAP. UGREEN brought Docker Engine 29.6.2 to UGOS Pro back in August with firmware 1.19.1. ASUSTOR offers Docker Engine 29.6.2 in App Central, with its latest build updated on October 27, 2026. TerraMaster moved its Container Manager to the Docker 29 branch in August and, on November 3, 2026, announced Docker Engine 29.7.1 for TOS 7 ARM. Even QNAP, which is certainly not a speed champion, is on 27.1.2. And Synology? 24.0.2. Last place, by a mile.
For years Synology has let us believe that a newer Docker Engine was on its way. For years we have waited, update after update. The promise has not been kept. Call it what you want; for me it is yet another Synology bluff.
🔓Synology-SA-26:18: Now We Know What DSM Update 1 Was Hiding
On October 12, 2026, Synology released DSM 7.4.1-90080 Update 1, and that very same day I published my article about the update, before anyone else. The changelog said only one thing: fixed multiple security vulnerabilities. No CVEs, no details, nothing. While others were still wondering whether it was worth installing, I had already told you, as always, to update. On November 10, 2026, Synology finally published the advisory Synology-SA-26:18 and now we can see what was behind that single line.
The advisory is rated Important and covers 25 CVEs in DSM: 8 Important and 17 Moderate. The affected products are DSM 7.4, fixed in 7.4.1-90080-1 or above, and DSM 7.3, fixed in 7.3.2-86009-5 or above. Under the Mitigation section, Synology wrote one word: None. In other words, the update is the only protection.
The three most serious ones have a CVSS score of 8.8: CVE-2026-13672, an authorization bypass in SSOAuth, CVE-2026-18792, a path traversal in the Sharing API, and CVE-2026-74857, a missing step in the authentication of the Auth API. All three allow remote authenticated users to read or write arbitrary files and conduct denial of service attacks. Then there are three at 8.1. CVE-2026-18596 is an authentication bypass in the OTP, which means an attacker with valid user credentials could get around the very thing that is supposed to save you when your password is stolen. CVE-2026-81584 is an SQL injection in the User API that can be abused by an attacker controlling a compromised LDAP or Active Directory server, and CVE-2026-19048 is a link resolution issue in the thumbnail component that allows writing arbitrary files. Completing the Important list: CVE-2026-18633 (7.5), an uninitialized pointer in nfsd that lets remote attackers without any account crash the service, and CVE-2026-75785 (7.2), an OS command injection in the VPN API for users with administrator privileges.
Among the Moderate ones there is a missing authentication in the WebDAV API (CVE-2026-15198) that lets remote attackers read specific files, a certificate validation flaw in the Support Form (CVE-2026-15201) open to man in the middle attacks and, irony of ironies, an incorrect authorization in Security Advisor itself (CVE-2026-124993) that lets remote attackers read specific files. The tool that should protect you needed protection too.
Now let me say something I have repeated for years. When an urgent security update comes out, install it, even when the details are not disclosed yet. This is exactly why. Vendors keep the details hidden precisely because the vulnerabilities are real and serious, and they want you patched before the bad guys read the advisory. Some people laughed at this advice. Some wrote to me: “I’ll wait a bit before updating.” Wait for what? For the CVE list? Here it is: 25 of them, with no mitigation other than the update. For a ransomware note on your shares? The day the details become public is the day the attackers get their map. If you followed the advice here on mariushosting, you were protected weeks before this advisory went online. If you are still waiting, stop waiting and update your DSM now.
📉Portainer Downloads Are Falling, and It Is Not a Coincidence
Something I have been watching closely: since I made the switch to Dockhand, Portainer downloads have dropped dramatically, above all in the NAS and self-hosting world. I am not surprised. Many of you followed my article How to Move Your Docker Containers From Portainer to Dockhand, many of you wrote to me to say that the migration took minutes and that you are not going back.
For me this is yet another proof that the community can respond together to changes it doesn’t want. Nobody organized a boycott, nobody shouted. People simply looked at the direction a tool was taking, found a better home and moved. Quietly, one stack at a time. That is the real power of the self-hosting world: WE ARE NOT LOCKED IN, and when a project forgets who made it popular, the community remembers. If you haven’t tried it yet, start here: Install Dockhand on Your Synology NAS or Install Dockhand on Your UGREEN NAS or Install Dockhand on Your Asustor NAS.
🎥Black Friday Is Here, and So Are the “Honest” YouTube Reviews
YouTube is being bombarded by pseudo influencers who earn commissions on every product sold through their links. Nothing wrong with affiliate links in themselves, but look at what many of them keep recommending: models like the UGREEN DH series, praised again and again as if they were top of the range. They are not. I explained why, point by point, in Which UGREEN NAS Should I Avoid? When someone pushes the weakest models as the best choice, it is clear that the goal is not to help you. The goal is to mislead the less experienced user, the one who trusts a smiling face and a nice thumbnail.
This blog doesn’t mince words. Mariushosting has no boss, no sponsor to please, no brand that tells me what to write, and it has never accepted to write things that are not true. So please, be very careful, especially now that Black Friday is starting. You will see. You will be bombarded by YouTubers who want to make easy money out of your inexperience, with “unmissable deals” on hardware they would never use themselves. It is something that personally annoys me a lot. Before you buy, read, compare, ask. A NAS stays with you for years. A bad recommendation lasts much longer than a discount.
📌Updates Worth Tracking Since the Start of November
Before we get to the less pleasant part, here are the updates from the first half of November that I would keep an eye on. Most of them are security fixes, so don’t leave them for later.
Vaultwarden 1.37.5 (November 1): fixes two Medium security advisories, one in website icons and one in emergency access, and the developers strongly advise updating as soon as possible. Release notes. Install Vaultwarden using my guides.
Immich 3.4.0 and 3.4.1 (November 10 and 11): version 3.4.0 brings a batch of security fixes, JPEG XL support, tags on mobile and new workflow triggers, while version 3.4.1 fixes the performance issues with shared links. Install Immich using my guides.
Pi-hole Docker 2026.11.0 (November 11): ships FTL v6.9, Core v6.6 and Web v6.6.1 with fixes for 11 security advisories. All the details are in my article Pi-hole Docker Version V6.6 2026.11.0.
UGREEN Black Friday (main sale November 19 to 30, early deals already live): the official Black Friday page puts the DH2300 and the DH4300 Plus right among its hot deals. A discount does not turn a weak NAS into a good one, so read Which UGREEN NAS Should I Avoid? before you buy.
Docker Engine 29.9.3 (November 3): fixes several security vulnerabilities in Docker Engine and its components. Synology users stuck on 24.0.2 will not get any of these fixes. Release notes.
🎗️Only 4 People Supported Since The Last Roundup
I have to be honest with you, as I always am. Since my last roundup at the end of October, only 4 people have supported this blog. Four. In two weeks full of security advisories, updated guides, so many articles and real tests on real hardware. The blog has no ads, no sponsors and no affiliate links, and it is exactly for this reason that I can tell you what I told you in the section above without fear of losing anyone’s money.
I continue to receive 0.01 cent donations. It happens often. They are not donations: they are mockery, sometimes accompanied by messages like “this is how much your work is worth.” Every refund costs me time and fees.
But independence has a cost. Every guide, every screenshot, every test is done by hand, by one person. If you want me to keep testing, writing guides and doing these roundups, help from the community is necessary. You’ll find everything here: Why I ask for donations. If any of these guides has ever saved you hours of frustration or protected your NAS in time, Please Support The Work. A heartfelt thank you to those four people, to those who already support and to those who decide to do so. You are the ones who keep all of this standing.
ℹ️A Small Personal Update
On this rainy November day I grabbed the umbrella and went out to get groceries at Auchan. Between the wet lights of the parking lot and the rain coming down, even a simple supermarket run felt a little special. For anyone asking, I just finished putting up the Christmas tree! I think it turned out pretty well. Sometimes that’s all it takes.
⚓No Noise, Just The Truth
In a month where everyone will try to sell you something, this blog will keep doing the only thing it knows: telling you how things really are. Update DSM and your packages, don’t trust reviews built on commissions, make your backups and choose your tools with your head, not with a thumbnail. The rest is noise. New articles and updated Compose files are already in the pipeline. See you in the next End of November 2026 Roundup update. Below you will find the most recent guides updated by mid November 2026.
Immich is a very high performance self-hosted photo and video backup solution directly from your mobile phone. You can run Immich on your Synology NAS and it lets you upload photos and videos from your browser or mobile phone via the dedicated Android Immich app or the iOS Immich app. The Immich user interface feels like Google Photos, especially if you are using the mobile apps.
Note: Install Immich on Your Synology NAS.
Note: Install Immich on Your UGREEN NAS.
Note: Install Immich on Your UGREEN NAS With GPU Acceleration.
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application which acts as a DNS sinkhole and optionally a DHCP server, intended for use on a private network.
Note: Install Pi-hole on Your Synology NAS.
Note: Install Pi-hole on Your UGREEN NAS.
Note: Install Pi-hole on Your Asustor NAS.
Technitium DNS Server is an open source authoritative as well as recursive DNS server that can be used for self hosting a DNS server for privacy & security. It works out-of-the-box with no or minimal configuration and provides a user friendly web console accessible using any modern web browser. Nobody really bothers about domain name resolution since it works automatically behind the scenes and is complex to understand. Most computer software use the operating system’s DNS resolver that usually query the configured ISP’s DNS server using the UDP protocol.
Note: Install Technitium on Your Synology NAS.
Note: Install Technitium on Your UGREEN NAS.
Note: Install Technitium on Your Asustor NAS.
Paperless-ngx is a document management system that transforms your physical documents into a searchable online archive so you can keep, well, less paper.
Note: Install Paperless-NGX on Your Synology NAS.
Note: Install Paperless-NGX on Your UGREEN NAS.
ArtCraft’s Crafting Apps bring a full suite of free, open-source creative and productivity tools to your Synology NAS. The project currently includes 16 native apps like PhotoCraft, VectorCraft, FilmCraft, LightCraft, PdfCraft, EffectCraft, DesignCraft, FigCraft, WordCraft, SoundCraft, DeckCraft, CADCraft, GridCraft, MailCraft, CraftAnything, TextureCraft and SolidCraft. Each of them is written from scratch in Rust as a clean-room alternative to familiar desktop software. You can run them on a Synology NAS through Docker. Community-built stream the apps to your browser so you can edit photos, cut video, design layouts, or work with documents directly from any device on your network without installing software on your computer. I’ve been running several of them on my own Synology for a few weeks now, and they’ve already replaced a lot of the subscription tools I used to rely on. Being able to open PhotoCraft or LightCraft straight from the browser on any device in the house, while keeping all my files on the NAS, has made quick edits and photo organization much easier without needing a powerful workstation or paying for Adobe.
Note: Install ArtCraft on Your Synology NAS.
Note: Install ArtCraft on Your UGREEN NAS.
Note: Install ArtCraft on Your Asustor NAS.
WikiDocs is an Open Source, databaseless, markdown, flat-file wiki engine. It’s designed to be simple yet powerful, making it a great tool for creating and managing wikis without the complexity of a database. Note: Install WikiDocs on Your Synology NAS.
Antimatter is a community-maintained fork of Mattermost that removes commercial restrictions, user/message limits, and other paywalled or enterprise-only elements, delivering a fully unrestricted open-source self-hosted team collaboration platform focused on chat and core features without the corporate overhead. In my homelab I’ve been running it for days as the central hub for family and a few friends. I use it for group chats, sharing links and files. It’s lightweight and reliable. Mattermost is the original product that increasingly puts limits and paid walls on previously free features. Antimatter is the cleaned-up, unrestricted fork that keeps only the open-source parts, removes all the commercial restrictions and nagging, and aims to stay fully free for self-hosters. Note: Install Antimatter on Your Synology NAS.
Note: Install Antimatter on Your UGREEN NAS.
Layerling is a free, open-source browser-based 3D CAD tool aimed at 3D printing enthusiasts who want functional parts without learning complex software or creating an account. It works much like Tinkercad: drag shapes onto a virtual build plate, turn some into holes, group them, and export. Layerling adds practical features such as chamfers and fillets that remain editable, sketches, threads, gears, hole patterns, hollowing, STEP export for true CAD geometry, multicolour support, and printer-specific build plates with overhang warnings. Designs stay entirely local in the browser, require no sign-up, and can even be driven by an AI assistant via its MCP server. I recently designed a simple phone stand with rounded edges and a cable slot using Layerling. Within a few minutes I had dropped a couple of boxes, cut the slot, applied a fillet to the top edges, and exported a clean STL, something that would have been far more fiddly in Tinkercad and far heavier in a full CAD package. The interface felt immediately familiar, the lack of any account friction was refreshing, and the part printed perfectly the first time.
Note: Install Layerling on Your Synology NAS.
Note: Install Layerling on Your UGREEN NAS.
Dockhand is a modern, self-hosted Docker management platform with an intuitive web interface for homelabs, small businesses, and enterprises. It simplifies container operations, stack deployments, and observability through real-time management (start/stop/restart containers, web terminals, file transfers), a visual Compose editor, GitOps auto-sync, metrics, logs, OIDC/SSO, MFA, vulnerability scans, and multi-host support via the open-source Hawser agent. You can deploy it quickly as a Docker container with no cloud dependencies or telemetry. It’s forever free for personal use.
Note: Install Dockhand on Your Synology NAS.
Note: Install Dockhand on Your UGREEN NAS.
Note: Install Dockhand on Your Asustor NAS.
Termix is an open-source, forever-free, self-hosted, all-in-one server management platform. It provides a web-based solution for managing your servers and infrastructure through a single, intuitive interface. Termix offers SSH terminal access, SSH tunneling capabilities, and remote file editing, with many more tools.
Note: Install Termix on Your Synology NAS.
Note: Install Termix on Your UGREEN NAS.
Dawarich is a self-hosted web app designed to replace Google Timeline (aka Google Location History). It enables you to: visualize your data on an interactive map, import your location history from Google Maps Timeline and Owntracks and explore statistics like the number of countries and cities visited, total distance traveled, and more.
Note: Install Dawarich on Your Synology NAS.
Note: Install Dawarich on Your UGREEN NAS.
💡Tagr
Tagr is a self-hosted web application that lets you browse, play, and edit the metadata of your music files from any browser. You simply point it at your music folders and get a clean three-panel interface for navigating the library, listening to tracks, and writing tag changes directly back to the audio files. It supports a wide range of formats, offers full change history with the ability to revert edits, includes a waveform-based player with listen tracking, and works smoothly on a NAS. I’ve been running Tagr as my everyday music library companion for a while now. Whenever I add new tracks or notice incomplete tags, I open it in the browser, fix the metadata on the spot, listen through the built-in player, and keep everything consistent without switching to a desktop app.
Note: Install Tagr on Your Synology NAS.
Note: Install Tagr on Your UGREEN NAS.
Dozzle is a simple and responsive application that provides you with a web based interface to monitor your Docker container logs live. It doesn’t store log information, it is for live monitoring of your container logs only. I use Dozzle on my NAS because it’s built in a way that allows me to read logs easily, without getting distracted by extra features, and troubleshoot issues more efficiently. It’s a window into my containers when something breaks and requires me to implement a fix quickly. Note: Install Dozzle on Your Synology NAS.
Formbricks is a solution for in-product micro-surveys that promises to supercharge your product experience. Formbricks provides a free and open source surveying platform. Gather feedback at every point in the user journey with beautiful in-app, website, link and email surveys.
Note: Install Formbricks on Your Synology NAS.
Note: Install Formbricks on Your UGREEN NAS.
Flare is a modern, self-hostable file sharing platform designed to work seamlessly with popular screenshot and sharing tools like ShareX and Flameshot. Built with Next.js and designed with simplicity in mind, it offers a complete solution for all your file sharing needs, with a strong focus on performance, customizability, and user experience. I’ve been using Flare for a few months now as my daily file-sharing tool on my Synology NAS, and it has completely replaced the clunky solutions I relied on before. The seamless integration with ShareX and Flameshot makes uploading screenshots effortless, the interface feels clean and modern, and the performance has been rock-solid even with larger files. Note: Install Flare on Your Synology NAS.
Reactive Resume V6 is a free, open-source resume builder that lets you create, update and share professional resumes and cover letters with no ads, no tracking and no paid tiers. You write on one side of the screen and see the finished page update in real time on the other; then you can export as PDF, Word, Markdown or JSON, or share it with a public link via your own domain name or DDNS. With the jump from v5 to v6, the whole app has been redesigned. The separate Resumes and Cover Letters dashboards are now a single Documents library, the editor is split into three focused modes (Write / Design / Check), the old Agents system has been replaced by an in-editor AI assistant that only proposes changes you approve, and a new PDF engine (Forme) makes the live preview match the downloaded file exactly. Cover letters are now standalone documents and the job-application tracker has been rebuilt around List, Board, Insights and Calendar views. I self-host the latest version on my Synology NAS with Docker so I keep full control of my data and always have the newest features available locally.
Note: Install Reactive Resume V6 on Your Synology NAS.
Note: Install Reactive Resume V6 on Your UGREEN NAS.
Floppy is a self-hosted, all-in-one media tracker and personal media diary that serves as a broader alternative to Trakt, Letterboxd, and TV Time. It unifies tracking for movies, TV, anime, manga, books, comics, games, board games, music, and podcasts into one library, history, and set of stats, with features like progress views, recap-style statistics, shareable lists, owned-media collections, and live integrations that keep your data private on your own hardware. Note: Install Floppy on Your Synology NAS.
Web-Check will help you get an insight into the inner-workings of a given website: uncover potential attack vectors, analyze server architecture, view security configurations, and learn what technologies a site is using. Currently the Web-Check dashboard will show: IP info, SSL chain, DNS records, cookies, headers, domain info, search crawl rules, page map, server location, redirect ledger, open ports, traceroute, DNS security extensions, site performance, trackers, associated hostnames, carbon footprint. The aim of Web-Check is to help you easily understand, optimize and secure your website.
Note: Install Web-Check on Your Synology NAS.
Note: Install Web-Check on Your UGREEN NAS.
Plane is an open-source software development tool to manage issues, sprints, and product roadmaps with peace of mind. It allows users to start with a basic task tracking tool and gradually adopt various project management frameworks like Agile, Waterfall, and many more. My personal experience with Plane: clean, modern UI and solid self-hosted performance felt lighter and more focused than most alternatives I’ve tried. I use Plane to manage personal side projects and small team sprints directly from my Synology NAS, keeping everything private and offline-capable without relying on cloud tools. Note: Install Plane on Your Synology NAS.
Homarr is a simple and lightweight homepage for your server that helps you easily access all of your services in one place. The thing I like most about Homarr is its speed and simplicity in adding links of your favorite docker apps. You can use it as a bookmark as well. It has great integration with Plex, Sonarr, Radarr, Pi-Hole etc. Homarr supports multiple configs and persistent storage. Running Homarr on my Synology NAS has helped me integrate all the apps I use daily into a clean and simple dashboard. I find it useful that I only have to configure my settings once, and the persistent storage feature allows me to return to the same configuration every time I open my Homarr setup.
Note: Install Homarr on Your Synology NAS.
Note: Install Homarr on Your UGREEN NAS.
Zoraxy is a lightweight, fast, and beginner-friendly reverse proxy written in Go, built for homelabs and self-hosters. It lets you easily expose web services, containers, and TCP/UDP traffic under custom domains with automatic Let’s Encrypt HTTPS, full HTTP/2 & WebSocket support, load balancing, flexible routing, and strong access controls (IP/country filtering, OAuth2, Basic Auth, Forward Auth). The clean web dashboard also includes real-time monitoring, traffic statistics, uptime checks, and handy built-in tools like mDNS/port scanners, traceroute, Wake-on-LAN, and a web-based SSH terminal. It runs as a single static binary on Linux, Windows, Raspberry Pi/ARM, NAS or Docker, with zero-downtime config changes and no complex files needed. Simple, powerful, and open-source. Note: Install Zoraxy on Your UGREEN NAS.
Sync-in is a secure, open-source platform for file storage, sharing, collaboration, and synchronization, giving users full data control through self-hosted infrastructure. It ensures privacy with no tracking or telemetry and offers granular permission management for users and groups at space and file levels. The platform supports cross-device synchronization with native desktop clients for Windows, macOS, and Linux, real-time collaborative document editing via OnlyOffice integration, and organized, secure spaces for personal, team, or public use. Files can be shared with specific users, groups, or via time-limited public links. It includes server-side full-text indexing for fast content search, activity history with notifications, and WebDAV support to mount spaces as remote drives. Note: Install Sync-in on Your Synology NAS.
JellyGlance is a modern, self-hosted dashboard for Jellyfin media servers that unifies live sessions, user statistics, recently added media, libraries, download queues, release calendars, webhooks, backups, request management, and integrations with tools like the Arr suite, Seerr apps, and download clients into one clean, customizable command center.
Note: Install JellyGlance on Your Synology NAS.
Note: Install JellyGlance on Your UGREEN NAS.
This post was updated on Sunday / November 15th, 2026 at 12:22 AM