X-twitter Facebook-f Pinterest-p
X-twitter Facebook-f Pinterest-p

Build your first homelab without breaking the bank with these Prime Day deals


If you’ve been looking at starting a homelab, but have been waiting for the perfect time, Prime Day is it. There are so many great homelab deals out there for Prime Day to explore. From discounted NAS servers to mini PCs and even networking gear, here are the homelab deals that stood out to me on Prime Day 2026.

Every homelab should start with a NAS

And there are a ton of fantastic deals going on right now

The heart of any homelab is networked storage. It’s utilized in every facet of the homelab, and should definitely be where you start your homelabbing journey.

You definitely can just take an old desktop or laptop, hook storage up to it, and go—but I’d recommend going a different route. Having a dedicated NAS (network attached storage) appliance is beneficial in so many ways.

For starters, almost all dedicated NAS systems support something called RAID—redundant array of independent disks. This means that you can have the NAS set up with redundancy in mind. So, if a hard drive happens to fail, you don’t lose everything stored on it.

RAID isn’t a backup, however, so you should definitely get a backup going once your homelab is on its feet. Also, please don’t buy desktop hard drives for your NAS—it’s just not worth the tradeoffs.

So, whether you haven’t started your homelab journey at all, or you’ve already got an old system, consider picking up a NAS this Prime Day. The deals are actually pretty solid, and having a dedicated storage appliance in your homelab is definitely worth it.

  • Ugreen DXP2800 GT NAS.

    Brand

    Ugreen

    Memory

    8GB (Upgradalble to 64GB)

    Drive Bays

    2x 3.5-inch, 2x M.2 NVMe

    LAN Ports

    10GbE

    The Ugreen DXP2800 GT NAS is the perfect starter system for anyone looking to get started in homelabbing. With two 3.5-inch drive bays and two NVMe slots, this NAS also supports user-upgradable RAM and has 10-gigabit networking.


  • Synology DS225+ Network Attached Storage server.

    Brand

    Synology

    CPU

    Intel Celeron J4125

    Memory

    2GB

    Drive Bays

    2

    Expansion

    None

    The Synology DS225+ is a great beginner storage server. It features two 3.5-inch hard drive bays and both 2.5Gb Ethernet and Gigabit Ethernet. Designed around Synology’s Disk Station Manager operating system, this NAS offers a simplified experience that anyone will feel at home using. 


Start your homelab ahead of the curve with a mini PC

A NAS is a great starter server, but a mini PC is better

My homelab started with a NAS, but I wish I would have picked up a dedicated server computer way sooner. These days, I run several mini PCs in my homelab and absolutely love it.

Mini PCs are fantastic for homelab use for a wide variety of reasons. For starters, they can be pretty affordable for the power they provide. Speaking of power, mini PCs typically use a fraction of the power that full-size desktops use.

Another reason I love mini PCs is because you can put whatever operating system you want on them. I run Proxmox on mine, but you could run Windows 11 (most ship with Windows 11 Pro) or any version of Linux that you can think of, really.

My first true server PC (that wasn’t also a NAS) was a big rack-mount server, and I wish I would have just gone with a mini PC instead. Don’t make the same mistakes I did, and just buy the mini PC. It’ll serve you better than a big beefy server for 99% of the tasks you’ll throw at it.

GEEKOM A5 mini PC.

Brand

GEEKOM

CPU

AMD Ryzen 5 7430U

Graphics

AMD Vega 7

Memory

16GB DDR4 SO-DIMM

Storage

512GB NVMe (expandable)

The GEEKOM A5 mini PC packs 16GB of user-replaceable RAM, a user-swappable NVMe SSD, plus two other storage slots, giving you plenty of user-upgradability in this compact system. The Ryzen 5 processor packs plenty of power for general tasks, and it’s even great at lightweight gaming and CAD work too.


Don’t limit yourself to just gigabit Ethernet

2.5Gb Ethernet gives you 2.5 times the transfer speeds

Side-angle close-up of UniFi US-48-500W managed PoE network switch cables and link lights. Credit: Patrick Campanale / How-To Geek

Up until last year, my entire homelab ran on traditional gigabit Ethernet just fine. However, I wasn’t utilizing my homelab to the fullest because big files took forever to transfer on my network.

In February of 2025, I finally took the multi-gig plunge and it’s another homelab thing I wish I would have done from the start. Running 2.5GbE networking in my homelab meant transfers finished 2.5 times as fast.

2.5 times faster transfers might not sound like a lot, but imagine a 10-minute transfer finishing in 4 minutes. Or, a 60-minute transfer completing in 24 minutes. It’s impressive how much time can be saved with a jump to 2.5GbE.

Most Ethernet cables you have around the house can likely handle transfer speeds of 2.5GbE, and a lot of computers, including mini PCs and laptops, are starting to ship with 2.5GbE ports.

Even if your computer doesn’t have a 2.5GbE port, it’s easy to add through a simple USB dongle—which is what I did for my MacBook.

Your homelab doesn’t have to cost a lot to be useful

I’ve seen people with pieced-together homelabs getting way more use out of their hardware than people with homelabs worth thousands of dollars. You don’t have to spend a crazy amount of money to get a useful homelab.

So, if you’ve been looking at starting your homelab journey, use Prime Day as the jumping off point!



Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

ChatGPT and Gemini could be quietly affecting your voting decisions, analysis shows

Nathan Austad Pleads Guilty in DraftKings Hacking Scheme, Gets 18 Months

Public Sector IT Services Cos Delivering Cloud and Security Solutions

The Real Story Is the Recovery

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Nathan Austad Pleads Guilty in DraftKings Hacking Scheme, Gets 18 Months

Public Sector IT Services Cos Delivering Cloud and Security Solutions

The Real Story Is the Recovery

One of the smallest power stations we’ve tested charges incredibly fast – and it’s $120 off

Nathan Austad Pleads Guilty in DraftKings Hacking Scheme, Gets 18 Months

Public Sector IT Services Cos Delivering Cloud and Security Solutions

The Real Story Is the Recovery

Recent Reviews

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites


Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Pierluigi Paganini
May 25, 2026

Threat actors are actively exploiting a security flaw, tracked as CVE-2026-26980, in Ghost CMS that was fixed months ago in real attacks against unpatched websites. According to Qianxin, the campaign has already affected more than 700 sites, including well-known organizations and universities.

The vulnerability is an SQL injection issue in Ghost’s Content API that can let an attacker read data from the database without logging in. In the worst case, this can expose the Admin API key, which can allow attackers to take over the site.

That key matters because it can be used to change published content. In this campaign, attackers used it to edit articles on compromised Ghost sites and insert malicious JavaScript at the end of pages. The goal was not just defacement, but to turn trusted websites into launch points for further malware delivery.

“After an in-depth investigation and analysis, we determined that this was not a targeted intrusion against the customer, but rather a large-scale poisoning campaign by an in-the-wild attack group targeting Ghost CMS. Although CVE-2026-26980 was publicly disclosed as early as February 19, a large number of users did not patch and upgrade in time, providing an opportunity for attackers.” reads the advisory published by Qianxin. “At least two groups are currently actively conducting such poisoning operations, and some sites have even become the target of competition between the two parties, with different malicious code being implanted one after another within a single day.”

The inserted code led visitors through a two-step chain. First, the page loaded a remote script that checked the browser and decided what the visitor should see. Then real victims were redirected to a fake verification page that looked like a normal “I’m human” check.

This is where the ClickFix part began. The page told users to press Windows+R, paste a command, and hit Enter. In practice, that command downloaded and started a malware payload on the victim’s machine. It was a classic social engineering trick: make the user do the dangerous part themselves.

Qianxin says the first signs of this activity appeared in early May. The malicious code found in the campaign had a compilation date of February 16, the same day Ghost announced the fix for CVE-2026-26980. That suggests the attackers moved quickly once they saw how many sites had not been updated.

The affected websites cover a wide range of sectors. Roughly half are personal blogs or independent sites, but the list also includes technology blogs, AI sites, media outlets, crypto projects, and educational institutions. Qianxin researchers say victims include sites linked to Harvard, Oxford, and DuckDuckGo.

The attack chain was also designed to be flexible. The loaders could fetch different payloads depending on the target, and the operators changed infrastructure several times.

“entire attack process has obvious five-stage characteristics of “CMS Takeover → Page Poisoning → Two-stage Loading → Social Engineering Lure (FakeCaptcha/ClickFix) → Malware Delivery”, and the entire process is highly automated: bulk vulnerability scanning → automatic key extraction → bulk injection → dynamic C2 distribution.” states the report.

In some cases, they switched domains after detection, keeping the campaign alive even when part of the chain was blocked.

“Through feature scanning of publicly accessible pages, we have cumulatively identified more than 700 poisoned victim domains, and have proactively contacted the sites for which contact information could be obtained, notifying them of the poisoning.” continues the report.

Qianxin also believes at least two different groups are involved. In some cases, the same site was hit more than once, with one attacker replacing the code left by another. That makes the campaign harder to clean up and shows how attractive compromised Ghost sites have become for abuse.

For site owners, the advice is straightforward. Ghost should be updated immediately, all credentials should be rotated, and site logs should be reviewed for suspicious admin API activity. Any injected scripts should be removed from the database itself, not just from the visual editor. Visitors who may have reached a poisoned site should also be warned.

The report includes Indicators of Compromise (IoCs) for the attacks observed by the researchers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ghost CMS)





Source link

Ghost CMS flaw abused to push ClickFix attacks on hundreds of sites

Third-Party Cyberattack Impacts Patient Information at The Oncology Institute

Lazarus APT unveils fileless RAT designed to evade detection

Copyright © 2024 All Rights Reserved.