Matters to platform and reliability teams: infrastructure and operations.
November 2, 2026 · Azure's edge falls over, and a record crypto heistOn 29 October an invalid tenant configuration propagated globally across Azure Front Door, overwrote the last-known-good snapshot, and crashed the data plane after passing rollout health checks. Microsoft halted customer config changes, ran a recovery that took about 4.5 hours, and kept changes frozen until 5 November while it added safeguards. Outlook, Teams, Intune, Power Apps and many third-party sites saw DNS failures, timeouts and 5xx errors. It was the second Front Door incident that month.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCISA added a GitLab CE/EE integer-overflow RCE (CVE-2026-97229, CVSS 10.0) and a Cisco Secure Firewall ASA/FTD denial-of-service flaw (CVE-2026-76418, CVSS 8.6) to its Known Exploited Vulnerabilities catalog on 29 October, both with a 1 November federal deadline. A day later it added two Ivanti Connect Secure flaws that chain with an earlier auth bypass to reach unauthenticated root. Volexity reported active exploitation; fixes are in ICS 25.1.1.3 and 22.8R2.6.
November 2, 2026 · Azure's edge falls over, and a record crypto heistBinance disclosed an incident affecting about 6.3 billion dollars in assets, with close to 3 billion frozen on-chain by Tether, Circle and Arbitrum. On 1 November the FBI attributed the theft to North Korea's TraderTraitor group (also tracked as Jade Sleet and UNC4899). Reporting says the attackers compromised a DevOps engineer's laptop, reached a service container, pre-signed consecutive withdrawal authorizations, and moved the funds in about 20 minutes.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCloudflare detailed eight eMudhra intermediate CA certificates whose private keys were literal small integers (4, 56, 66 and others), letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare saw about 22,000 handshake attempts using the weak keys and a forged certificate dated under an hour after the public bug report. A week later, more than half of probes still accepted the chain.
November 2, 2026 · Azure's edge falls over, and a record crypto heistA tampered copy of Anthropic's Claude Code extension, version 2.1.313, was published to the Cursor marketplace and stayed live about 11 hours on 29 October, reaching up to 5,000 developers. It collected username, Git email and public IP and attempted a reverse SSH tunnel and persistence across Windows, macOS and Linux. Anthropic said a malicious actor used access to the marketplace to publish a copy it did not build.
November 2, 2026 · Azure's edge falls over, and a record crypto heistHosting platform Northflank disclosed a breach on 30 October in which stored environment variables were decrypted and customers' AI API keys were stolen and misused. Northflank told customers to assume all stored environment variables were compromised and to rotate every key, database password, token and secret. It followed similar breaches at Railway earlier in the month.
November 2, 2026 · Azure's edge falls over, and a record crypto heistA use-after-free in the kernel's IPv4 TCP path affecting multipath TCP listeners is tracked as CVE-2026-98432 and rated CVSS 9.8 by the kernel CVE team. Eight stable kernels shipped around 30 October with the fix. Anthropic reported that an AI model wrote a working exploit for the race.
November 2, 2026 · Azure's edge falls over, and a record crypto heistCloudflare mitigated 18.2 million network-layer DDoS attacks in the third quarter, up 38 percent year over year, and blocked 14.4 trillion HTTP DDoS requests. Short-burst attacks under 10 minutes and under 1 Gbps rose 208 percent. Cloudflare attributes the growth to booter and stresser-for-hire services.
November 2, 2026 · Azure's edge falls over, and a record crypto heistInfoQ reported remarks by Amazon CEO Andy Jassy that AWS committed capacity is largely sold out through 2027, with part of 2028 already allocated, while AWS holds back headroom for On-Demand, EC2 and Bedrock. Some practitioners report trouble getting On-Demand capacity in certain regions.
November 2, 2026 · Azure's edge falls over, and a record crypto heistGitHub introduced a preview npm package firewall that inspects downloads at install time and blocks suspicious packages before they install, the same week as the Northflank and Claude Code extension supply-chain incidents.
November 2, 2026 · Azure's edge falls over, and a record crypto heistA SigNoz essay arguing that AI tooling erodes the depth of SRE skill drew 677 points and about 500 comments on 30 October. It ran alongside a Pragmatic Engineer piece questioning whether any AI SRE has genuinely been on call.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityPHP maintainers released fixes on 21 October for CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution rated CVSS 9.2. The highest risk is mod_php, where an unauthenticated request can trigger the flaw before any application code runs. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Krebs reported working exploits already circulating.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityCloudflare found eight eMudhra intermediate CA certificates whose private keys were catastrophically weak, letting anyone recover the signing key and forge a certificate for any domain. These intermediates chain to roots trusted by Mozilla, Microsoft, Apple and Chrome. Cloudflare deployed mitigations on 19 and 20 October, and eMudhra later said it will exit the global TLS certificate business.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityA malicious LiteLLM 1.107.0 was published to PyPI on 21 October with a credential stealer and a persistent backdoor that polled GitHub for commands. Attackers used stolen GitHub CLI credentials to bypass branch protection and build from a lookalike repo before PyPI removed it. The same day, Railway disclosed unauthorized access to systems holding customer environment variables, some decrypted, and told customers to rotate everything.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityCVE-2026-88771 is an unauthenticated remote command-execution flaw in NetScaler Gateway, exploitable in default configuration and confirmed exploited in the wild by CISA and Mandiant. Cloudflare recommends putting authentication and WAF controls in front of the appliance because patching lags exploitation.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityLinux 7.3 shipped on 18 October with 18,765 commits from 3,021 developers. Notable additions include a new failfs filesystem, an fchroot() syscall, VM working-set tracking and extensive SMB server work.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityQuad9 announced on 22 October that it will cease serving French users on 24 November rather than comply with a court order to block DNS resolution of allegedly infringing domains. Quad9 argues geo-scoped blocking is technically unworkable without imposing French law globally.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityAWS announced on 22 October that its service to find, validate and prioritize code vulnerabilities and deliver fixes as pull requests is generally available. AWS positions it as replacing hours of manual investigation.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityIn a 21 October post, GitHub described moving a copy of 99.99999 percent of its repositories to Azure and explained how per-reference quorums and object storage will migrate the rest, so reads can scale independently for agent-generated load.
October 26, 2026 · PHP's emergency patch and a broken certificate authorityA maintainer's post announcing he had archived all his Ruby gem repositories drew about 526 points and 514 comments on Hacker News around 19 October, surfacing open-source sustainability concerns.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOn 13 October Microsoft shipped fixes for more than 1,400 vulnerabilities, roughly ten times a normal month, with at least 78 rated critical. CVE-2026-96951, a Windows Shell security-feature bypass affecting Windows 10, 11 and some Server versions, is confirmed exploited in the wild. A .NET Framework bypass, CVE-2026-108398, was publicly disclosed before the patch but not yet exploited at publication.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOn the night of 11 October attackers set refrigeration controllers at up to about 700 French supermarkets into defrost mode overnight. Some units reached well over 50 degrees Celsius, with equipment melting, fires and sprinkler water damage, and similar incidents hit stores elsewhere in Europe. Reporting attributed the targeting to networked refrigeration control systems; no group claimed responsibility.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireOpenCode disclosed that attackers accessed a legacy system being decommissioned, exposing third-party API keys for OpenAI, Anthropic and Google that users had saved in OpenCode Console workspaces. The company said about 1.4 percent of Console users were affected, and Anthropic revoked affected Claude API keys. The open-source CLI itself was not the breached component.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireAnthropic described leaving Git after merge volume rose from 2,500 daily changes in May to 30,000 in September, with a 100GB monorepo history and CI that would have generated huge traffic. Its replacement, Scion, is server-centric with clients fetching on demand, and reports much smaller infrastructure and far faster checkouts. The post drew 900 points and over 1,000 comments on Hacker News.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireCitizen Lab documented the first publicly confirmed zero-click mercenary spyware delivery through targeted ads. A panel let customers target by mobile ad ID, cookie or IP, and a server returned malicious JavaScript to infect selected devices, delivering Candiru spyware. The ads reached nearly 200,000 apps and sites.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireAnnounced on 12 October, Lambda Web Functions run standard HTTP web apps on Lambda without rewriting them into event handlers, supporting up to 128 concurrent requests per instance and billing on active CPU time plus memory. Supported frameworks include Express, Hono, Fastify and Next.js on Node.js 24.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireGitHub's availability report described a 13 September incident where a background data-cleanup job overwhelmed a shared primary database, failing most web issue-creation and signup requests for about an hour and a half, and a 28 September Copilot code-review incident where incomplete results meant reviews never posted.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireA high-engagement GitHub issue filed on 12 October reports that the Codex CLI installs a persistent, self-updating background daemon by default, raising concerns about consent, auto-update behaviour and running an always-on process.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireA CSO Online piece arguing that recent incidents framed as agents going rogue actually stem from skipping decades-old containment and monitoring practices drew 952 points and 630 comments on 14 October.
October 19, 2026 · The largest Patch Tuesday ever, and fridges set on fireA sysadmin's account of a registrar seizing and disabling all their domains drew 695 points and 366 comments on 18 October, sparking discussion of registrar concentration and lack of recourse. The underlying claim is a single user report.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionDanish authorities disclosed that attackers abused a private company's legitimate access to the Central Person Register (CPR), running about 14 million automated searches in September before detection in early October. Exposed data includes names, addresses and CPR numbers for roughly 8.8 million people, about 80 percent of the register. A party claiming responsibility said access came via an IT company account protected by the password 123456.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionCloudflare announced on 9 October the acquisition of Deno, including the team and the open-source runtime. The Deno runtime gets one more year of bug fixes and security updates, Deno Deploy shuts down in six months with paid users migrated to Cloudflare Workers, and the JSR registry keeps running. Terms were not disclosed.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionA researcher published CVE-2026-107181, an IPC-injection flaw in Telegram Desktop through version 7.2.8 combined with an unauthorized URI scheme that enables arbitrary local file read and exfiltration, leading to account takeover from a single malicious link click. It is rated CVSS 8.1 and fixed in version 7.2.9.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionKrebs reported that before recent arrests, the ShinyHunters group extorted Jeppesen ForeFlight, a former Boeing subsidiary. Related reporting ties the group to mass exploitation of CVE-2026-35273, a PeopleSoft and Oracle vulnerability, beginning in June, with published firewall mitigations bypassed through URL-encoding.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionPolars 2.0 shipped on 6 October with initial spill-to-disk support, streaming by default on collect, expanded SQL and a native Arrow MapType. The breaking change: the streaming engine no longer guarantees row order by default for operations like join, group_by and unpivot, so set maintain_order where ordering matters.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionYandex's data center in Russia's Vladimir region shut down on 11 October after a reported drone attack and fire, taking more than 80 Yandex Cloud services offline. It was the third Yandex data center hit in four days.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionOxide Computer announced a 445 million dollar Series D led by Eclipse, at a reported valuation near 6 billion dollars, bringing total funding to roughly 835 million. Reporting says Oxide reached profitability this year with demand exceeding production.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionThe Swedish DPA fined Miljödata about 160,000 euros under GDPR Article 32 for insufficient technical and organizational security, including the lack of automated real-time intrusion and anomaly monitoring. About 2.2 million individuals were affected.
October 12, 2026 · Denmark's population register breached, Uber fined 825 millionThe Kubernetes blog published two operational posts this week, one on the shift to cgroup v2 and what it means as cgroup v1 goes into maintenance mode, and one on scaling workloads with node swap for memory-heavy agentic AI workloads.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedCISA added three exploited flaws to its Known Exploited Vulnerabilities catalog. CVE-2026-86950 is an out-of-bounds write in Apple's CoreGraphics (CVSS 8.8), fixed in iOS and macOS updates and triggered by processing a malicious file. CVE-2026-76504 is a critical authentication bypass in Cisco Catalyst SD-WAN Manager (CVSS 9.8) with no workaround. CVE-2026-104286 is a path-traversal flaw in Fortinet FortiMail (CVSS 9.8) allowing unauthenticated file write.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedOn 28 September a routine Firebase config cleanup pushed a payload that the Google Analytics for Firebase iOS SDK failed to validate, crashing apps using the SDK on launch. Per the postmortem, per-app crash duration ranged from two to six hours. Firebase status dashboards stayed green throughout because they track server-side health, not client-side SDK crashes, and Google committed to representing SDK outages on its dashboards.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedDebian published DSA-6528-1 on 29 September, fixing an unusually large batch of Linux kernel CVEs that may lead to privilege escalation, denial of service or information leaks. Debian stable is fixed in kernel 6.12.111-1, and the advisory drove a widely read Hacker News thread.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedAWS announced that Amazon Aurora PostgreSQL can directly query Apache Iceberg and Parquet data in a data lake alongside live operational data with no ETL, using an embedded DuckDB engine so a single query can join transactional and historical data.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedAWS announced the public preview of a Well-Architected Agent that analyzes an AWS environment and returns recommendations across cost, security, performance and resilience, with suggested fixes.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedA GitButler post arguing that Git 3.0's planned switch to SHA-256 as the default would break existing SHA-1 hash references for limited practical benefit drew 583 points and over 500 comments on 1 October.
October 5, 2026 · Three exploited edge bugs, and an app crash the status page missedSimon Willison argued that agentic AI tooling needs default hard budget caps to prevent runaway spend, drawing 652 points and 313 comments on 3 October.
