Practical DevOps, Cloud, AI & Linux engineering guides

Exchange Online incident EX1550543 disrupted Outlook, Teams and Copilot for more than a day. Microsoft's own updates describe servers failing health checks, an overwhelmed secure-connection process, and a reverted network change.

A password-authentication bypass in sshd built without PAM lets a single long password log in to accounts that have no password at all. Alpine is the main target, CISA lists it as exploited, and the federal deadline is November 12. Checks, fixed packages and the one-line stopgap.

Git 2.56.1 and six backports fix six CVEs, including code execution during recursive clones and a merge heap overflow that GitLab rates Critical inside Gitaly. The git on your runners, images, forge and laptops updates through different channels. Checks for each one, fixed versions and stopgaps.

The PlanetScale defaults that matter in production: safe migrations on main, deploy requests with a real revert plan, queries shaped for Vitess limits, and scoped credentials.

In multi-user Kubeflow Pipelines through 2.17.3, the HTTP upload endpoints skip authorization for shared pipelines. Any tenant can push a new version, and unpinned recurring runs in other namespaces will execute it. Checks, an audit script, the fix and the stopgap.

Terraform codebases rarely fail on day one. They fail on day 400. Fifty lessons from Terraform in Depth, fact-checked against current Terraform and OpenTofu, with code and a 20-point checklist.

An automated tool is using stolen GitHub tokens to plant ci-sync branches whose workflow prints every secret base32-encoded, grabs the log and deletes the run. How to hunt for it across an org, what to rotate, and the controls that stop the next one.

Three CVSS 9.9 Argo CD repo-server bugs can be reached by anyone with Application get, the permission most teams hand to every viewer. Fixed versions, the v2 and 3.3 support cliff, and the RBAC and config checks to run today.

An out-of-bounds write in Google's Brotli decoder, now on CISA's KEV list, reaches Node.js through zlib and Envoy and Istio through the Brotli decompressor filter. Fixed versions, cluster-wide checks and what to block until you patch.

A FROM line pointing at a host like x.azurecr.io.attacker.com is enough to make kaniko hand the build's Entra ID token to that host. Which kaniko forks and images are affected, how to find Azure identities in your build pods, and what to rotate.

.NET 8, .NET 9, the Lambda dotnet8 runtime and the Azure Functions in-process model all lose support on November 10, 2026. Inventory commands, the isolated-worker migration and a CI gate.

One workflow that builds, signs keylessly with GitHub OIDC, attaches an SBOM and SLSA provenance, plus the Kyverno policy that refuses anything unsigned. Copy it, change three names, ship it.