Title: Automated watch of vulnerabilities affecting my infrastructure
Author: Solène
Date: 23 October 2026
Tags: security selfhosting automation ci ai devops
Description: In this blog post, I share how I get notifications,
tickets and fix pull requests for newly published vulnerabilities
affecting my infrastructure
# Introduction
Keeping an eye on published vulnerabilities is part of my work, but
there are now too many CVE published every day to read them all, and
the delay between the publication of a vulnerability and its first
exploitation also became very short. In my opinion, this work cannot
reasonably be done by hand anymore.
My infrastructure is already updated automatically for nearly all its
components, so most of the time a fix arrives without me doing
anything. But sometimes, I need to react faster than the update, for
example to set up a workaround while waiting for a patched version.
For this, I need to know quickly when a vulnerability affecting me is
published.
In this blog post, I share the small setup I made to receive alerts
about vulnerabilities that affect my infra, with issues tracking and
maybe a fix created as a PR automatically when possible. There is
nothing exceptional here, but it may give ideas to some readers.
# How it works
My infrastructure is described entirely as code in a git repository
hosted on my Forgejo instance. Forgejo is a self-hosted "forge", like
Gitlab, and it comes with a CI compatible with GitHub Actions.
This CI job runs three times a day, in the morning before I wake up, at
noon before I go back to work, and in the evening just before the end
of my work day, in case it is useful for my job. It does the
following:
* build an inventory of what runs in my infrastructure from the
repository (container images and system packages)
* fetch the recent announcements from a list of security feeds
* send the inventory and the announcements to a language model, which
keeps only the serious vulnerabilities affecting my setup
* for each new alert, ask the model to create a fix as a pull request
if possible
* open an issue in Forgejo to keep track of the alert
* warn me over XMPP
The model only sees a high level view of the infrastructure, which is
enough to know which software runs where and how it is updated. The
prompt asks it to ignore what does not matter to me (denial of service
only, XSS, products I do not use) and also to suggest a workaround,
like the commands to run or a configuration change such as disabling
the vulnerable feature or blocking a path in the reverse proxy.
The issue title contains the CVE identifier that is checked before
opening a new issue to avoid duplicates, and I close the issue when it
is handled or if it is a false positive.
The pull requests are never merged automatically, they are only here to
save me time, especially when the fix is trivial like changing the
version of a container image. Of course, they must be reviewed before
merging.
# Sources
Here are some of the feeds I use:
* the CISA KEV catalog, the list of vulnerabilities known to be
actively exploited
* the GitHub security advisories with critical and high severity, most
of the projects I am using are published on GitHub so it works fine
* the Ubuntu security notices, for the packages of my Ubuntu containers
* the oss-security mailing list, where open source projects often
announce issues before other sources
(HTM) CISA Known Exploited Vulnerabilities Catalog
(HTM) GitHub Advisory Database
(HTM) Ubuntu Security Notices
(HTM) oss-security mailing list
# The language model
I use the Mistral API with the model `ministral-14b`, it is available
with their free offer. From my experience, a 14B model (14 billions
parameters) is good enough for this task, because it does not have to
be smart, it only needs to read announcements and compare them with my
inventory.
I chose Mistral because I need to improve my skills about AI, it is a
provider I had never used before, and it is the only one I found with a
free offer giving access to an API. This would work with any other
provider without problem. A 14B model also runs on hardware that an
individual can have at home for a reasonable price, so this could run
on-premise.
# Notifications
I chose XMPP for the alerts because I have an XMPP client on all my
systems and the notifications work well everywhere. The message is
sent with `go-sendxmpp` from a dedicated account. This is really a
personal choice, it could have been Matrix, SMS, a Mattermost, Slack or
Teams webhook, whatever floats your boat.
(HTM) go-sendxmpp project page
For each alert, I get two things:
* an issue in Forgejo explaining why the vulnerability was classified
as relevant, with its severity and a link to the source
* an XMPP message with a link to the issue, a short summary and the
affected components
# Conclusion
It has not been running for long, so it is still being tuned, but it
already caught CVE-2026-111497 quickly, a serious remote code execution
vulnerability.
This setup does not replace my usual cybersecurity watch, I still read
security advisories and releases feeds. It completes it, especially on
days where I am really busy and that I could have missed something
important.