Securing The Homelab Against AI And Cyber Attacks

My Self-hosting and homelab journey has been an enjoyable one. I've scaled up to the point I have over 100 containers spread across several servers, including a Docker Swarm. Many of the services these host are web-facing, which means my attack surface was quite large. This past week, I discovered just what that means. With Plex2Shell and PHP2Shell vulnerabilities hitting in the same week, I was reminded the price of having so many web-facing services.

The story starts with PHP, and the recent CVEs. After becoming aware of the criticality of the vulnerability, I quickly spun up an AI agent to evaluate my homelab for any PHP instances which were vulnerable. I had over 20 instances of PHP which were vulnerable, and most were web-facing. The sad part is, most were docker containers without official patched releases yet, but with the exploit out in the wild, I had to act. I shut down web access to these containers, and asked AI to manually patch the impacted PHP instances. This took some time, but thankfully the PHP instances were patched quickly.

I was finally finished later that evening. Just when I thought I could relax, a friend of mine sent me an Instagram Reel about a new vulnerability- Plex2Shell, which was also alarming. The content creator stressed that people should update their Plex servers immediately, so I spun up the AI agent again- this time to assist me in checking to see if I was in danger. Sure enough, things were worse than I thought. I had already been exploited.

When I found this out, the first thing I did was pull the plug. I blocked Plex access at the router, then I began collecting some forensics on what went down. This is where my AI agent really showed its worth, as it was able to parse through all the logs, collect data, and write a detailed incident report. Within the report, I learned that it was exploited several times, but the attacker was unable to run any remote commands or scripts due to my Plex Docker Container being non-standard, meaning the attack was likely automated, and made false assumptions about my setup. While it was exploited, my AI agent only saw failed attempts to run code.

Plex was quickly updated, and the vulnerability was cleared, but my account was compromised. I had to rotate my keys, but that was the only harm done. The Plex instance was isolated to a Docker Container, so the impact was limited. I was properly concerned about the future of my homelab if I was so easily exploited. With AI dramatically augmenting malicious actors, empowering them to find and use exploits, I took this as a sign that it was time to lock down.

While I won't go into specifics, I ended up using a multi-layered approach to locking down my public facing services. I feel much more comfortable with my current attack surface, as attackers will be unable to touch almost all of my services. Only a few remain which need to be truly public- this blog being one of them. However, I have a list of recommendations I would like to give to anyone out there as concerned about cyber threats.

Let's make a list of things I believe could be beneficial.

1: VPN into your homelab for most

This is critical. Many of the services you host are meant for you alone, so exposing them to the internet is almost never necessary. By using a VPN connection with something like Wireguard or Tailscale, you're giving yourself access while denying anyone else. Just remember that you need to patch the VPN endpoint as well.

2: Geoblock regions that shouldn't be accessing your public IP.

This is something I do at my router. The people who need access to my services are within the US, so I can blanket block many countries from accessing my network. You could also whitelist regions vs blacklist. There are lots of benefits for doing this, but it won't protect you by itself.

3: Use a Reverse Proxy, and configure it well

I use NGINX Proxy Manager (NPM) for many services. Some are public, like this blog, but many are for friends and family. For those, I configured NPM to require users to authenticate with my authentication server prior to serving these services. This ends up being an effective strategy to ensure that attackers don't get to even see or probe the service without proper authorization.

4: Update often

This doesn't really need to be said, but it's true. Automated backups can help, although you must be careful even with that due to the risk of say, supply chain attacks. I like to have a weekly update schedule for most of my services, but always keep your ear to the ground for new CVEs.

I can't stress enough that the time is now to think about security for your home network, homelab, self hosted servers and services. While the risks have always been there, the advent of AI has accelerated the rate at which vulnerabilities are found and exploited, necessitating the need for us to be proactive. It has shortened the distance between disclosure and exploitation. The time to implement strong safeguards is now, and while a homelab can be a hobby for many, complacency can come at a high cost. Implement strong safeguards now, as I anticipate it is only going to get crazier from here.

For more information, take a look at the /r/selfhosted subreddit. It's a great place to discuss self-hosted services, as well as learn about how to defend them.