Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News

Jaksot

• 
  Amazon Linux 2027, GitHub Actions Cache Security, Secret-Scanning Merge Blocks, N-central CVSS 10 RCE, Karmada Graduation, ShieldCrash, CodeQL ARM64 & When Observability Fails Too 12.09.2026 14min

  This week on Ship It Weekly: Amazon Linux 2027 enters public preview with kernel 7.1+, SELinux enforcing by default, DNF5, newer language runtimes, AWS-LC, and an x86-64-v3 baseline. GitHub Actions adds explicit cache permissions to reduce cache-poisoning risk. GitHub can now block pull requests from merging when they introduce exposed secrets. And N-able N-central has a critical pre-auth RCE that Huntress says is being actively exploited in the wild. The bigger theme this week is catching problems before they turn into incidents. Amazon Linux 2027 gives teams time to test AMIs, bootstrap scripts, agents, Terraform, CloudFormation, and CI/CD before the next platform generation becomes production reality. GitHub’s new cache controls make workflow trust boundaries explicit instead of leaving them implied. And secret-scanning rulesets move credential detection directly into the merge path, where developers can actually act on it. In the lightning round: Karmada graduates from the CNCF as multi-cluster and distributed AI scheduling grow, ShieldCrash research claims another Microsoft Defender patch bypass with SYSTEM-level access, CodeQL 2.27 adds native Linux ARM64 support, and Dependabot can now read private GitHub Packages without another personal access token.And the human closer is about what happens when observability shares the same failure domain as the thing it is watching. A full disk is bad enough. It gets worse when logs stop writing, monitoring data disappears, and the tools used to diagnose the outage start failing too. The takeaway is not that every monitoring component needs total isolation. It is that you should know what can blind you, and make sure at least one useful signal survives the failures you care about most.LinksAmazon Linux 2027 Public Previewhttps://tsn.io/NHlEaAmazon Linux 2027 Overview and Preview Detailshttps://tsn.io/izDYxAmazon Linux 2027 Known Issues and Preview Limitationshttps://tsn.io/tdugdGitHub Actions Cache Permissions with cache-modehttps://tsn.io/8p94nBlock Pull Requests with Exposed Secrets from Merginghttps://tsn.io/BspA2N-able N-central 2026.3 Hotfix 4https://tsn.io/xredGHuntress: N-able N-central Vulnerability and Active Exploitationhttps://tsn.io/QjNd5Karmada Graduates from the CNCFhttps://tsn.io/lcJGhMicrosoft Defender ShieldCrash Zero-Day Researchhttps://tsn.io/YfsJ6CodeQL 2.27 Adds Linux ARM64 Supporthttps://tsn.io/lxfnFAutomatic Dependabot Access to GitHub-Hosted Registrieshttps://tsn.io/pSilAShip It Weeklyhttps://www.tellerstech.com/go/siw/On Call Briefhttps://www.tellerstech.com/go/ocb/
• 
  AWS GWLB TCP Reset, Azure DevOps Live Migrations to GitHub, GitHub Runner Enforcement, Docker Root Risk, Lambda IAM Updates, PostgreSQL Upgrade Traps, SonicWall Zero-Days & Better Incident Reviews 04.09.2026 17min

  This week on Ship It Weekly: AWS Gateway Load Balancer gets TCP Reset, giving applications a faster way to recover when firewalls or other inline appliances fail instead of waiting minutes for TCP retries to time out. Microsoft puts Enterprise Live Migrations into public preview for moving Azure DevOps repositories to GitHub Enterprise Cloud with data residency while developers keep working. GitHub is beginning enforcement against outdated self-hosted Actions runners. And Omarchy fixes a Docker configuration that effectively gave normal desktop processes a path to root.The bigger theme this week is failure modes hiding inside infrastructure we already trust. A dead network path can look like a slow application. A repository migration involves far more than copying Git history. A self-hosted runner can quietly become unsupported while it continues looking healthy. And giving a developer access to the Docker socket may sound like convenience until you remember that the Docker group is effectively a root-level privilege.In the lightning round: Lambda gets full IAM resource-based policies, AWS warns that circular PostgreSQL role memberships can stall major RDS and Aurora upgrades, a researcher releases the FalconFlank CrowdStrike privilege-escalation PoC while CrowdStrike investigates, and SonicWall patches two SMA1000 zero-days after confirming active exploitation.LinksAWS Gateway Load Balancer TCP Resethttps://www.tellerstech.com/go/s-d7e609ab/Azure DevOps Enterprise Live Migrations Public Previewhttps://www.tellerstech.com/go/s-ea05aff9/GitHub Actions Self-Hosted Runner Minimum Version Enforcementhttps://www.tellerstech.com/go/s-6e8540c4/Omarchy: Any User Process Can Escalate to Roothttps://www.tellerstech.com/go/s-d22971c3/AWS Lambda Full IAM Resource-Based Policieshttps://www.tellerstech.com/go/s-ff2a04b5/Fix Circular Role Dependencies Before Upgrading RDS and Aurora PostgreSQLhttps://www.tellerstech.com/go/s-e4578f52/FalconFlank CrowdStrike Privilege Escalation PoChttps://www.tellerstech.com/go/s-8c21b00b/SonicWall SMA1000 Zero-Day Advisoryhttps://www.tellerstech.com/go/s-559ffc8b/Remote Incident Reviews: Async First, Live Later?https://www.tellerstech.com/go/s-68ca9f5e/This Week’s On Call Briefhttps://tsn.io/L95NSShip It Weeklyhttps://www.tellerstech.com/go/siw/On Call Briefhttps://www.tellerstech.com/go/ocb/
• 
  Cloudflare Saves 100TB of RAM, AI Drives Server Prices Up, AWS Adds a Fourth London AZ, Route 53 DNS Self-Service, AKS eBPF Routing, Go 1.27, and the Danger of Hidden Infrastructure Assumptions 29.08.2026 16min

  This week on Ship It Weekly: Cloudflare explains how five low-level optimizations to the cache behind 1.1.1.1 freed roughly 100 terabytes of RAM while also improving performance. OVHcloud is raising infrastructure prices as AI demand reshapes the memory supply chain. AWS adds a fourth Availability Zone to London, exposing automation that quietly assumed there would always be three. And Route 53 Global Resolver gets a cleaner cross-account model for DNS self-service.The bigger theme this week is assumptions. A few wasted bytes do not matter until you have 250 billion cache entries. A Region having three Availability Zones feels permanent until AWS adds a fourth. And centralized DNS governance works fine until every application team needs a networking ticket just to make a private zone resolvable.In the lightning round: new research looks at manipulating DRAM controller translation registers and the assumptions that creates for memory isolation, AKS eBPF Host Routing reaches general availability, CloudFront Functions can now put custom context directly into access logs, and Go 1.27 lands generic methods along with runtime, tooling, and standard-library improvements.And the human closer looks at an easy Kubernetes mistake: running kubectl against the wrong cluster. Because the active context belongs to the kubeconfig rather than a terminal tab, changing it in one shell can silently affect another. It is a good reminder that some friction is worth keeping around production, and that the safest guardrails live somewhere stronger than operator memory.LinksCloudflare: How We Saved 100 Terabytes of Memory by Optimizing 1.1.1.1’s DNS Cache https://www.tellerstech.com/go/s-9d6c2943/OVHcloud Raises Prices as AI Memory Demand Reprices Non-AI Infrastructure https://tsn.io/tnaYjAWS Adds a Fourth Availability Zone to Europe (London) https://tsn.io/YfGxaShared DNS Views with Amazon Route 53 Global Resolver https://tsn.io/WEyigDRAM Controller Register Manipulation Breaks CPU Memory Isolation https://tsn.io/QKr1xAKS eBPF Host Routing https://tsn.io/T3PMhCloudFront Functions Unified Logging https://tsn.io/nTXLnGo 1.27 https://tsn.io/vfXITkubectl Ran on the Wrong Cluster? Fix Your Context Switching https://tsn.io/6LxfGThis Week’s On Call Brief https://tsn.io/064QEShip It Weekly https://www.tellerstech.com/go/siw/On Call Brief https://www.tellerstech.com/go/ocb/
• 
  Ship It Conversations: Justin Garrison of Sidero Labs on Kubernetes, Platform Engineering, AI, Golden Paths, and Knowing What to Say No To 24.08.2026 41min

  This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It Conversations episode, I talk with Justin Garrison of Sidero Labs about Kubernetes, platform engineering, bare metal, AI, golden paths, and why knowing what to say no to may be one of the most important skills a platform team can develop.Justin is Field CTO at Sidero Labs, the company behind Talos Linux, and co-host of Fork Around and Find Out.We start with the evolution of Kubernetes and how managed services like EKS and GKE made Kubernetes easier to consume while also pulling teams deeper into proprietary cloud ecosystems. Justin explains why on-prem and bare metal are getting renewed attention, especially as teams look at cloud costs, data sovereignty, and the operational overhead that comes with constantly optimizing cloud environments.We also get into where Kubernetes helps and where it becomes self-inflicted pain. Justin talks about abstraction, cognitive load, and why teams tend to use familiar tools for problems they were never really designed to solve.A big part of the conversation is platform engineering and golden paths. Justin argues that every organization needs its own path, but platforms become dangerous when they try to centralize everything. He shares why one of the best decisions his team made at Disney Plus was simply saying no to stateful workloads.We also talk about what really belongs in a platform: security controls, logging, monitoring, software supply chain visibility, and cost management. Justin explains why centralization can help in those areas, but can become a bottleneck when applied too broadly.Near the end, we get into AI, security, tooling dependency, and engineering culture. Justin makes the point that people have always formed strong attachments to tools, and AI is another version of that. The challenge is knowing where AI actually helps versus where it becomes another dependency teams stop questioning.The big takeaway: good platform engineering is not about supporting everything. It is about understanding what should be standardized, what should stay flexible, and what your team should explicitly refuse to own.Highlights• Why Kubernetes has become increasingly productized• Why some teams are moving back toward on-prem and bare metal• Where cloud cost optimization starts to become its own operational burden• Why Kubernetes helps with abstraction and cognitive load• Why familiar tools often get used for the wrong workloads• What golden paths actually represent inside an organization• Why platform teams need to know what to say no to• What should and should not be centralized• How AI changes engineering workflows without changing the need for judgment• Why finding work you actually enjoy matters for avoiding burnoutLinksSidero Labs: https://www.siderolabs.comTalos Linux: https://www.talos.devJustin Garrison: https://justingarrison.comFork Around and Find Out: https://www.forkaroundandfindout.comMore episodes and show notes: https://shipitweekly.fmOn Call Brief: https://oncallbrief.comLMGT Awards: https://lmgt.org
• 
  GitHub Outage, PleaseFix Agentic Browser Vulnerability, AWS Certificate Manager Drops Email Validation, Cloudflare TypeScript CI Workflows, AI Observability Consolidation, and the Hidden Cost of “Simple” Platform Changes 21.08.2026 17min

  This week on Ship It Weekly: GitHub suffers another widespread outage affecting the web interface, APIs, Actions, authentication, Copilot, and other critical developer workflows. Zenity Labs demonstrates PleaseFix attacks against agentic browsers, where malicious content can influence agents with access to authenticated sessions and privileged tools. AWS Certificate Manager is moving away from email validation, and Cloudflare is experimenting with CI pipelines defined as TypeScript instead of YAML.The bigger theme this week is dependencies and boundaries we tend to ignore until something breaks. GitHub is no longer just where the code lives. Agentic browsers are no longer just displaying webpages. Certificate renewal is not something you want depending on someone checking an inbox. And CI pipelines have become software systems of their own.LinksGitHub Hit by Widespread Outage https://devops.com/github-hit-by-widespread-outage-halting-work-for-global-developers/Zenity Labs: PleaseFix in Agentic Browsers https://zenity.io/company-overview/newsroom/company-news/zenity-labs-exposes-the-full-scope-of-pleasefixAWS Certificate Manager Ending Email Validation https://aws.amazon.com/blogs/security/aws-certificate-manager-will-discontinue-email-validation-to-prove-domain-validation-for-certificates/Certificate Expiry Is Still Taking Down Major Platforms https://tokentimer.ch/blog/tls-certificate-expiry-outagesCloudflare Turns CI Pipelines into TypeScript Workflows https://www.infoq.com/news/2026/08/cloudflare-ci-code-workflows/Dynatrace Acquires Arize https://devops.com/dynatrace-acquires-arize-as-ai-agents-deepen-the-observability-challenge/AWS Open-Sources Dogwood https://www.infoq.com/news/2026/08/aws-dogwood-agent-policy/Pulumi v3.258.0 https://github.com/pulumi/pulumi/releases/tag/v3.258.0AWS Key Breach and Data-Transfer Signal https://assets.theregister.com/2026/08/13/20267/Mario Saved the EU but Broke My System https://www.uptimelabs.io/articles/hamed-2012-outage-reflectionsThis week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W34/Ship It Weekly https://shipitweekly.fm/
• 
  Ship It Conversations: Ned Bellavance of Ned in the Cloud on DevOps Beyond the Buzzwords, Terraform, AI, the Future of Infrastructure as Code, and Why Fundamentals Still Matter 16.08.2026 36min

  This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It Conversations episode, I talk with Ned Bellavance of Ned in the Cloud about DevOps beyond the buzzwords, platform engineering, infrastructure as code, AI, and why fundamentals still matter even as the tools change.Ned is the founder of Ned in the Cloud and host of the Day 2 DevOps podcast, with more than 20 years in IT across systems administration, cloud, architecture, automation, and technical education.We start with a problem a lot of teams run into: adopting the ceremonies of DevOps without actually adopting the principles. Standups, sprints, pipelines, and tooling can make an organization look mature, but the real goal is better communication, faster feedback loops, and delivery tied to actual outcomes.We also talk about how teams decide what to prioritize next. Security, reliability, performance, FinOps, and platform work can all matter, but chasing whatever is newest does not help if the basics are still broken.A big part of the conversation is where infrastructure as code goes from here. We get into Terraform's state and scaling model, API rate limits, the Terraform/OpenTofu split, Terragrunt, and newer approaches like Swamp from System Initiative. AI is making infrastructure code cheaper to produce, but understanding the architecture behind that code is becoming more valuable.That leads into learning and career development. We talk about why networking, Linux, databases, security, cloud architecture, and troubleshooting still matter, even if an LLM writes most of the syntax. Build things, get them wrong in controlled environments, troubleshoot them, and learn what is happening underneath the abstraction.The big takeaway: tools will keep changing. Judgment, architecture, troubleshooting, and understanding the systems underneath them are much harder to automate away.Highlights• Why DevOps ceremony is not the same as DevOps principles• How teams should decide what platform work actually matters• Why basic security hygiene still matters• Where Terraform's current state model starts to hit limits• Terraform, OpenTofu, Terragrunt, and the future of infrastructure as code• How AI changes the value of writing infrastructure code• Why architecture and troubleshooting skills become more important• Why breaking things in controlled environments is one of the best ways to learnLinksNed in the Cloud: https://nedinthecloud.comDay 2 DevOps: https://day2devops.comNed in the Cloud on YouTube: https://www.youtube.com/c/NedintheCloud/Ned Bellavance on LinkedIn: https://www.linkedin.com/in/ned-bellavance/Swamp: https://swamp.clubTerraform: https://developer.hashicorp.com/terraformOpenTofu: https://opentofu.orgMore episodes and show notes: https://shipitweekly.fmOn Call Brief: https://oncallbrief.com
• 
  Railway US East Outage, Stripe’s Graph-Based Database Recovery, Kata Containers Host Escape, DynamoDB Vector Search, AWS Network Firewall Proxy, Gateway API 1.6, and containerd 2.4 14.08.2026 15min

  This week on Ship It Weekly: Railway explains how an upstream network problem turned into a much larger US East outage, including storage traffic falling back onto the management network and stale connections continuing to cause problems after routing recovered. Stripe shares how graph search and state machines helped cut database pager volume by about 30 percent. Kata Containers patches a critical guest-to-host escape, and DynamoDB adds native vector search.The bigger theme this week is what happens after the obvious failure. Fixing the route does not necessarily clear the connections created while it was broken. Automating recovery does not have to mean handing an AI agent unrestricted production access. And stronger isolation does not eliminate the components that still cross the guest-host boundary.In the lightning round: AWS brings explicit forward proxy functionality back through Network Firewall, Gateway API 1.6 moves TCPRoute and UDPRoute to stable, and containerd 2.4 enters beta with new functionality alongside breaking changes worth finding before your next runtime upgrade. LinksRailway: July 2, 2026 US East Services Outage https://blog.railway.com/p/incident-report-july-2-2026-us-east-services-outageStripe: How Stripe uses graph search and state machines to auto-remediate a global database fleet https://stripe.dev/blog/how-stripe-uses-graph-search-and-state-machines-to-auto-remediate-a-global-database-fleetKata Containers: Guest-root to host-root escape via virtiofs https://github.com/kata-containers/kata-containers/security/advisories/GHSA-2gv2-cffp-j227Amazon DynamoDB now supports real-time vector search https://aws.amazon.com/about-aws/whats-new/2026/08/amazon-dynamodb-vector-search/AWS Network Firewall forward proxy preview https://aws.amazon.com/about-aws/whats-new/2026/08/aws-network-firewall-forward-proxy-preview/Gateway API v1.6: TCPRoute and UDPRoute Graduate to Standard https://kubernetes.io/blog/2026/08/03/gateway-api-v1-6-release/containerd 2.4 beta https://github.com/containerd/containerd/releasesCNCF: Learning Cloud-Native Engineering Beyond Tutorials Through LFX https://www.cncf.io/blog/2026/08/10/learning-cloud-native-engineering-beyond-tutorials-through-lfx/This week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W33/Ship It Weekly https://shipitweekly.fm/
• 
  AI Agents Target GitHub, Kubernetes 1.37 Deprecations, AWS Transit Gateway Policy Routing, IAM Identity Center Multi-Region, Cloudflare Meerkat, AMOS Mac Malware, and the Risk of Half-Migrated Production Systems 07.08.2026 18min

  This week on Ship It Weekly: AI agents from Anthropic and OpenAI took unsanctioned actions on the real internet during UK government cyber testing, including an attempt to push malicious code into a real GitHub project. Kubernetes 1.37 starts retiring IPVS mode, pushes cgroup v1 closer to removal, and brings an SELinux volume change worth testing before upgrades. AWS Transit Gateway gets policy-based routing, and IAM Identity Center expands multi-Region support to organizations using AWS’s built-in directory.The bigger theme: access is not the same thing as authority, and availability is not just about whether your application is running. Agents need boundaries around the actions they can take. Routing policies need enough visibility to explain why traffic went where it did. And regional resilience does not help much if the people responding to the outage cannot authenticate.In the lightning round: Cloudflare’s Meerkat consensus system, AMOS macOS malware, N-able’s incomplete N-central fix, and an AWS CLI bug that disabled SSH host-key verification.LinksAISI: Unsanctioned agent behaviour during cyber testing https://www.aisi.gov.uk/blog/incident-report-unsanctioned-agent-behaviour-during-cyber-testingKubernetes v1.37 Sneak Peek https://kubernetes.io/blog/2026/07/31/kubernetes-v1-37-sneak-peek/AWS Transit Gateway Policy-Based Routing https://aws.amazon.com/about-aws/whats-new/2026/07/aws-transit-gateway-policy-based-routing/AWS IAM Identity Center multi-Region directory support https://aws.amazon.com/about-aws/whats-new/2026/07/aws-iam-identity-center-extends-multi-region-support-to-identity-center-directoryCloudflare: Introducing Meerkat https://blog.cloudflare.com/meerkat-introduction/Atomic macOS / AMOS stealer infection https://isc.sans.edu/diary/rss/33208N-able N-central exploitation after incomplete fix https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.htmlCVE-2026-18654: AWS CLI EMR SSH host-key verification https://aws.amazon.com/security/security-bulletins/rss/2026-071-aws/CloudFront VPC Origins half-migrated incident https://www.reddit.com/r/devops/comments/1vdovj6/the_cloudfront_vpc_origins_outage_caught_me/This week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W32/More episodes https://shipitweekly.fm/
• 
  Telstra’s Time Sync Outage, DoorDash’s 1.5M RPS Cache, Stateless MCP, GitHub and PyPI Supply Chain Delays, and Why the Quietest Infrastructure Often Has the Biggest Blast Radius 31.07.2026 16min

  This week on Ship It Weekly: Telstra’s mobile network jumped back to 2006 after a timing device restarted with the wrong date, disrupting calls, data sessions, and hundreds of emergency calls.DoorDash explains how Entity Cache, built with Envoy and Valkey, handles more than 1.5 million requests per second and uses stale-data policies, invalidation, and fallback behavior as a reliability layer.The latest MCP release candidate removes protocol-level sessions, making servers easier to scale behind ordinary load balancers while leaving teams responsible for authentication, tracing, retries, rate limits, and application state.GitHub and PyPI are also adding friction to package automation. Dependabot now delays routine updates by three days, while PyPI blocks new files from releases older than 14 days.LinksTelstra outage https://www.telstra.com.au/exchange/our-mobile-network-outage-has-been-resolved-heres-what-happenedDoorDash Entity Cache https://careersatdoordash.com/blog/high-performance-proxy-cache-for-doordash-services/MCP specification release candidate https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/Dependabot package cooldown https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/PyPI release-file restrictions https://blog.pypi.org/posts/2026-07-22-releases-now-reject-new-files-after-14-days/Amazon ECS Action Logs https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-ecs-action-logs/Network Load Balancer listener rules https://aws.amazon.com/about-aws/whats-new/2026/07/aws-network-load-balancer-supports-listener-rules/Amazon Managed Prometheus limits https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-managed-service-prometheus-1500m-metrics-workspace/PixelSmash in FFmpeg https://jfrog.com/blog/pixelsmash-critical-ffmpeg-vulnerability-turns-media-files-into-weapons/SRE Weekly Issue 527 https://sreweekly.com/sre-weekly-issue-527/This week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W31/More episodes https://shipitweekly.fm/
• 
  Ship It Conversations: Jay Lark of Hookbridge on Webhook Reliability, Retries, Idempotency, Replay, HMAC Security, Local Testing, and Operating Webhooks in Production 27.07.2026 31min

  This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It Conversations episode, I talk with Jay Lark of Hookbridge about webhook reliability, retries, idempotency, replay, security, local development, and what happens when a simple HTTP POST becomes production infrastructure.Jay is a Principal DevOps Engineer and the founder of Hookbridge, a service focused on making webhook delivery more reliable and easier to operate.We start with the basic model: one service sends an HTTP POST to another when something happens. The happy path is easy. The problems begin when an endpoint is unavailable, responds too slowly, receives duplicate events, or gets them out of order.Jay explains what “at least once delivery” means and why receivers must expect duplicates. We talk about idempotency, event IDs, retry behavior, availability during deployments, and why returning a 200 does not prove downstream processing succeeded.We also dig into observability and security. Teams need enough visibility to know whether a webhook arrived, whether signature verification passed, what response was returned, and where processing failed. Jay breaks down HMAC signatures, timestamps, replay protection, and why a valid signature still does not replace normal business-logic validation.Local development is another source of friction. External providers cannot send events directly to localhost, so developers often rely on temporary tunnels, staging deployments, copied payloads, or mocks. Jay explains how Hookbridge uses a fixed URL and local client to forward real webhook traffic to a developer’s machine.We also talk about n8n, self-hosted OpenClaw systems, Hookbridge pull endpoints, and when polling may be simpler or safer than exposing another inbound endpoint.The big takeaway: design the failure path before a webhook becomes business-critical. Verify the sender, expect duplicate and out-of-order events, build enough visibility to debug failures, and have a replay strategy before the first incident.Highlights• Why webhooks are harder than “just an HTTP POST”• What at-least-once delivery means for receivers• Why idempotency, retries, and event ordering matter• What teams need for webhook observability and debugging• Where HMAC signatures, timestamps, and replay protection fit• Why local webhook development is still awkward• When polling or pull-based delivery may be a better fit• When teams should stop building webhook infrastructure themselvesLinksHookbridge: https://hookbridge.ioHookbridge local development CLI: https://www.hookbridge.io/cli.htmlHookbridge pull endpoints: https://www.hookbridge.io/pull.htmlJay Lark on LinkedIn: https://www.linkedin.com/in/jay-lark-ba7a3b5/OpenClaw: https://openclaw.aiMore episodes and show notes: https://shipitweekly.fmOn Call Brief: https://oncallbrief.com
• 
  AWS CloudFormation Express Mode, Spark 4.2 Vector Search, AI Speeds Coding but Not Delivery, Platform Governance Developers Won’t Hate, and Why Could Is Not the Same as Should 24.07.2026 18min

  This week on Ship It Weekly: AWS CloudFormation Express mode promises faster infrastructure feedback by reporting deployments complete before extended resource stabilization finishes. Apache Spark 4.2 adds native vector operations and nearest-neighbor joins, giving some teams a way to keep AI data workloads closer to the platforms they already run.GitLab’s latest research says AI is helping developers generate and commit code faster, but review, testing, governance, and deployment are not accelerating at the same pace. Then, a platform engineering case study from Sevdesk shows how minimum viable governance, useful feedback, and progressive enforcement can improve compliance without turning the platform team into another approval queue.The theme this week: making one part of the system faster does not automatically improve the whole system.In the lightning round: OpenShift 4.22.5 receives an important security update, outdated autoscaling thresholds disrupt GitHub Actions, Cloudflare experiences an incident where some POST requests fail to reach customer origins, and GitHub Code Quality becomes generally available—with automatic billing attached.The episode closes with Reid Savage reflecting on their first year managing Honeycomb’s SRE team and the difference between what a capable team could do and what it should do.LinksCloudFormation Express mode https://aws.amazon.com/blogs/aws/accelerate-your-infrastructure-deployments-by-up-to-4x-with-aws-cloudformation-express-mode/Apache Spark 4.2 https://spark.apache.org/releases/spark-release-4-2-0.htmlGitLab AI Accountability Report https://about.gitlab.com/resources/ai-accountability-survey-2026/Platform governance at Sevdesk https://www.infoq.com/presentations/platform-engineering-team-compliance/OpenShift 4.22.5 security update https://access.redhat.com/errata/RHSA-2026%3A37585GitHub Actions incident https://github.com/orgs/community/discussions/201795Cloudflare status https://www.cloudflarestatus.com/GitHub Code Quality GA https://github.blog/changelog/2026-07-20-github-code-quality-is-now-generally-available/Could vs. Should — Reid Savage https://www.honeycomb.io/blog/could-should-first-year-managing-sre-teamThis week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W30/More episodes and full show notes https://shipitweekly.fm/
• 
  Ship It Conversations: Mat Ryer of Grafana Labs on AI Observability, Agents, Evals, and Operating AI in Production 20.07.2026 45min

  This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It Conversations episode, I talk with Mat Ryer of Grafana Labs about AI observability, production agents, evals, telemetry cost, guardrails, and what changes once AI moves beyond demos and into systems teams actually depend on.Mat is Senior Director of AI at Grafana Labs, where he focuses on how AI fits into observability and production systems.We talk about Grafana Assistant, why AI observability is not just logs, latency, and HTTP 200s, and how teams can measure whether agents are actually helping. Mat gets into evals, LLM-as-judge patterns, traces as a way to think about conversations, user feedback, tool choice, model changes, and the cost of collecting new telemetry.We also dig into UX and trust. If an AI assistant gives you a wall of text, you still have to decide whether to believe it. If it can show the graph, deep link into Grafana, apply filters, and expose the source data, that becomes a much more useful operating experience.The big takeaway: start small, enhance workflows you already have, build feedback loops, and treat production AI like something you actually have to operate.Highlights• Why AI demos are easy, but production AI is harder• Why agents need observability, evals, and guardrails• How Grafana thinks about AI Assistant and AI observability• Where LLM-as-judge patterns, traces, tool calls, and feedback fit• Why telemetry cost problems may repeat with AI workloads• Why UX matters when operators need to trust the answer• Where AI can help SRE and platform teams todayLinksMat Ryer on LinkedIn: https://www.linkedin.com/in/matryer/Mat Ryer on GitHub: https://github.com/matryerGrafana Labs: https://grafana.comGrafana Assistant: https://grafana.com/products/cloud/ai-assistant/Grafana AI Observability: https://grafana.com/docs/grafana-cloud/machine-learning/ai-observability/Grafana Adaptive Telemetry: https://grafana.com/products/cloud/adaptive-telemetry/Grafana MCP server: https://github.com/grafana/mcp-grafanaOpenTelemetry: https://opentelemetry.ioPrometheus: https://prometheus.ioGrafana Loki: https://grafana.com/docs/loki/latest/More episodes and show notes: https://shipitweekly.fmOn Call Brief: https://oncallbrief.com
• 
  GitHub API Enumeration, Grok Build CLI Data Exposure, AWS Security Hub Network Scanning, AI-Powered Patch Pressure, and Why Visibility Is Not Ownership 18.07.2026 19min

  This week on Ship It Weekly: Datadog tracked coordinated GitHub API enumeration, xAI’s Grok Build CLI reportedly uploaded repo data without redaction, AWS Security Hub added Network Scanning and exposure impact analysis, and Microsoft says AI-powered vulnerability discovery is changing patch pressure.The theme: visibility is not ownership. A GitHub API map does not revoke a token. An exposure finding does not close a port. A patch bulletin does not patch the fleet. And an AI coding tool reading your repo is still access.Brian covers GitHub as a production surface, AI coding tool data boundaries, cloud exposure based on reachability and blast radius, and why patching needs to look more like production operations than spreadsheet theater.Also, the Ship It Weekly shop is open at shop.tellerstech.com with Ship It Weekly t-shirt designs. Use coupon code SHIPTHESTORE for 20% off your order for the next few weeks.LinksDatadog: Coordinated GitHub API enumeration https://securitylabs.datadoghq.com/articles/coordinated-github-api-enumeration/The Verge: Grok Build CLI repository upload report https://www.theverge.com/ai-artificial-intelligence/965600/spacexai-grok-build-repository-uploadAWS Security Hub Network Scanning https://aws.amazon.com/about-aws/whats-new/2026/07/aws-security-hub-network-scanning/AWS Security Hub impact analysis for exposure findings https://aws.amazon.com/about-aws/whats-new/2026/07/impact-analysis-aws-security-hub/Microsoft: Windows vulnerability management and AI-powered discovery https://blogs.windows.com/windowsexperience/2026/07/09/evolving-windows-vulnerability-management-to-meet-the-speed-of-ai-powered-discovery/SRE Weekly Issue 525 https://sreweekly.com/sre-weekly-issue-525/HalluSquatting / hallucinated package risk https://www.endorlabs.com/learn/slopsquatting-when-ai-agents-hallucinate-malicious-packagesAWS Lambda Managed Instances for Java cold starts https://aws.amazon.com/blogs/compute/eliminating-java-cold-starts-with-aws-lambda-managed-instances/This week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W29/Ship It Weekly shop https://shop.tellerstech.com/More episodes and full show notes https://shipitweekly.fm/
• 
  EKS Rollbacks, GitHub Actions Supply Chain Attacks, AI Agentjacking, CloudWatch Log Alarms, and Why Safety Nets Don’t Replace Ownership 10.07.2026 19min

  This week on Ship It Weekly: Amazon EKS added Kubernetes version rollbacks, Novee Security published Cordyceps research on GitHub Actions supply chain risk, Tenet Security showed how fake telemetry can hijack AI coding agents, and Amazon CloudWatch added alarms directly from log queries.The theme: safety nets are getting better, but the blast radius is getting wider. Rollback buttons, log alarms, zone-aware routing, secret scanning, and AI agent workflows all help, but they do not replace ownership.Brian covers why EKS rollbacks are useful but not a substitute for real upgrade discipline, why GitHub Actions YAML is production code with credentials, how fake Sentry telemetry can become hostile agent context, and why easier log-based alarms can also mean easier pager noise.In the lightning round: ECS Service Connect zone-aware routing, etcd 3.7, GitHub innersource advisories, secret scanning metadata improvements, and CloudWatch Application Signals service events.LinksAmazon EKS Kubernetes version rollbacks https://aws.amazon.com/blogs/aws/upgrade-amazon-eks-clusters-with-confidence-using-kubernetes-version-rollbacks/Novee Security: Cordyceps supply chain research https://novee.security/blog/cordyceps/Tenet Security: Agentjacking through fake Sentry errors https://tenetsecurity.ai/blog/agentjacking-coding-agents-with-fake-sentry-errors/Amazon CloudWatch log query alarms https://aws.amazon.com/about-aws/whats-new/2026/07/amazon-cloudwatch-log-alarms/ECS Service Connect zone-aware routing https://aws.amazon.com/about-aws/whats-new/2026/07/ecs-service-connect-zone-aware/etcd 3.7 announcement https://etcd.io/blog/2026/announcing-etcd-3.7/GitHub innersource security advisories https://github.blog/changelog/2026-07-08-innersource-security-advisories-are-generally-available/GitHub secret scanning extended metadata and multipart validation https://github.blog/changelog/2026-07-07-secret-scanning-extended-metadata-and-multipart-validation/CloudWatch Application Signals service events https://aws.amazon.com/about-aws/whats-new/2026/06/cloudwatch-service-events/Our LinksThis week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W28/More episodes and full show notes https://shipitweekly.fm/
• 
  Ship It Conversations: Evan Phoenix of Miren on Deployment Pain, Terraform, Waypoint, and Better Defaults for Small Teams 06.07.2026 41min

  This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It: Conversations episode, I talk with Evan Phoenix of Miren about why deployment is still painful, what teams keep getting wrong when they try to simplify it, and why small teams may need better defaults more than more platform knobs.Evan is the CEO of Miren. He previously worked on Terraform Enterprise and Waypoint at HashiCorp, and he also built Puma and Rubinius.We talk about deployment as the “final boss” of software delivery. Not because teams do not know how to ship code, but because deployment is where everything collides: runtimes, registries, secrets, networking, cloud services, databases, rollbacks, and the internal platform nobody wants to touch anymore.A big theme is opinionated tooling. Engineers often say they want flexibility, but many teams are really asking for good defaults, a clear happy path, and fewer decisions to own.We also get into Terraform Enterprise, Terraform Cloud, Terragrunt, OpenTofu, Waypoint, Kubernetes, Heroku, ECS, container registries, and how AI changes the deployment conversation. AI can generate infrastructure code, but when that setup breaks, someone still has to understand it and be on call for it.Highlights• Why deployment is still painful after years of platforms and abstractions• What Evan learned from Terraform Enterprise and Waypoint• Why Terraform structure, state, modules, and repo layout remain hard• Why OpenTofu gained traction beyond the Terraform licensing change• Why Kubernetes can be too much surface area for some teams• What small teams actually need from deployment tooling• How AI changes infrastructure and deployment workflows• Why generated infrastructure still needs ownership and accountabilityLinks• Miren: https://miren.dev• Miren on GitHub: https://github.com/mirendev• Evan Phoenix: https://evanphx.dev• Evan on Bluesky: https://bsky.app/profile/evanphx.dev• Evan on Linkedin: https://www.linkedin.com/in/evanphoenix/Things mentioned• Terraform Enterprise: https://developer.hashicorp.com/terraform/enterprise• Terraform Cloud: https://developer.hashicorp.com/terraform/cloud-docs• Terragrunt: https://terragrunt.gruntwork.io• OpenTofu: https://opentofu.org• HashiCorp Waypoint: https://github.com/hashicorp/waypoint• Knative: https://knative.devOur linksMore episodes + show notes: https://shipitweekly.fmOn Call Brief: https://oncallbrief.com
• 
  Amazon Q CVEs, Hijacked npm and Go Packages, AWS WAF HTTP/2 Issues, Lambda MicroVMs, and Why Execution Is the Boundary Now 03.07.2026 18min

  This week on Ship It Weekly: Amazon Q Developer and the AWS language servers had a pair of trust-boundary CVEs, JFrog found hijacked npm and Go packages using hidden VS Code tasks to run malware when a workspace opens, AWS WAF had HTTP/2 request-body inspection issues, and AWS introduced Lambda MicroVMs for running user-generated and AI-generated code in isolated sandboxes.The bigger theme: execution is the boundary now. The repo, the IDE, the AI assistant, the WAF, and the sandbox all sit at the point where something gets to run, inspect, block, or decide. Before execution, trust is a policy. After execution, trust is a blast radius.In the lightning round, Brian covers GitHub’s record advisory volume, Git 2.55, Valkey 9.1 on Amazon ElastiCache, and a quick Fable 5 callback now that Anthropic’s Fable 5 is back online.LinksAWS security bulletin: Amazon Q / AWS language server CVEs https://aws.amazon.com/security/security-bulletins/2026-047-aws/JFrog: Hijacked npm packages using VS Code tasks https://research.jfrog.com/post/hijacked-npm-vscode-tasks-blockchain/AWS security bulletin: AWS WAF HTTP/2 inspection issues https://aws.amazon.com/security/security-bulletins/2026-048-aws/AWS Lambda MicroVMs https://aws.amazon.com/blogs/aws/run-isolated-sandboxes-with-full-lifecycle-control-aws-lambda-introduces-microvms/GitHub Advisory Database record volume https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/Git 2.55 highlights https://github.blog/open-source/git/highlights-from-git-2-55/Amazon ElastiCache Valkey 9.1 https://aws.amazon.com/blogs/database/announcing-valkey-9-1-for-amazon-elasticache/Claude Fable 5 and Mythos 5 model docs https://platform.claude.com/docs/en/about-claude/models/introducing-claude-fable-5-and-claude-mythos-5This week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W27/More episodes and full show notes https://shipitweekly.fm/
• 
  Ship It Conversations: Kat Traxler of Vectra AI on AI Security, the Zero-Day Clock, IAM, and Cloud Risk 28.06.2026 42min

  This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It: Conversations episode, I talk with Kat Traxler of Vectra AI about AI security, the zero-day clock, IAM, cloud risk, AI-assisted bug hunting, and why the scariest future security problems may still start with the boring fundamentals teams already struggle with today.Kat is a Principal Security Researcher at Vectra AI focused on abuse techniques and vulnerabilities in the public cloud, especially around the intersection of cloud security, AppSec, IAM, managed identities, and insecure-by-design flaws.We talk about the current AI security mood, from the excitement around faster research and bug hunting to the fear that AI could shrink the window between vulnerability disclosure and exploitation. Kat explains the “San Francisco Consensus,” why the zero-day clock is getting so much attention, and why she thinks the facts may be real while some of the conclusions are overextended.The bigger theme here is that AI is absolutely changing security work, but it does not erase the fundamentals. Attackers still take the lowest-friction path that works. For most teams, that still means credentials, IAM, misconfigurations, known vulnerabilities, and systems that were never threat-modeled as deeply as people assume.Highlights• Why AI security feels exciting and unsettling at the same time• What the “San Francisco Consensus” means and why people are talking about the zero-day clock• How AI may shrink the time between vulnerability disclosure and exploitation• Why Kat is skeptical of the full “zero-day apocalypse” narrative• Why credentials, IAM, misconfigurations, and known vulnerabilities still matter most for many teams• How AI helps narrow the search space in bug hunting and security research• Where AI is useful for code-level bugs, and where it still struggles with context and threat modeling• Why human expertise still matters when using AI for writing, research, and cloud security analysis• Why IAM remains hard because it sits at the intersection of people, access, and technology• What insecure-by-design flaws are, and why AI may not solve those anytime soonKat / Vectra AI links• Kat Traxler at Vectra AI: https://www.vectra.ai/about/author/kat-traxler• Kat’s site: https://kattraxler.cloud/• The San Francisco Consensus: https://kattraxler.cloud/the-san-francisco-consensus/• Kat on X: https://x.com/NightmareJS• Vectra AI: https://www.vectra.ai/Our linksMore episodes + show notes + links: https://shipitweekly.fmOn Call Brief: https://oncallbrief.com
• 
  containerd CRI Vulnerabilities, Datadog PostgreSQL HA on Kubernetes, AWS DevOps Agent with Datadog MCP Server, EKS Control Plane Egress, and Why Users Feel the Wait 26.06.2026 19min

  This week on Ship It Weekly: containerd disclosed a batch of CRI plugin vulnerabilities, Datadog tested PostgreSQL high availability on Kubernetes and found that failover is not useful if it cannot happen safely, AWS DevOps Agent and Datadog MCP Server moved AI incident response closer to real production workflows, and Amazon EKS added customer-routed control-plane egress.The bigger theme: the control plane keeps getting wider. Runtimes, databases, incident agents, API-server egress, credentials, the cloud console, and object metadata are all becoming part of the production blast radius. And when something breaks, users do not experience your architecture diagram. They experience waiting.In the lightning round, Brian covers GitHub self-service credential revocation for incident response, AWS Management Console Private Access without internet connectivity, Vercel Connect and short-lived agent credentials, and Amazon S3 annotations.Linkscontainerd CRI plugin vulnerabilities / AWS security bulletin https://aws.amazon.com/security/security-bulletins/2026-046-aws/Datadog: PostgreSQL high availability on Kubernetes https://www.datadoghq.com/blog/engineering/postgresql-ha-kubernetes/AWS DevOps Agent and Datadog MCP Server https://aws.amazon.com/blogs/devops/production-ready-autonomous-incident-resolution-with-aws-devops-agent-now-ga-and-datadog-mcp-server/Amazon EKS customer-routed control-plane egress https://aws.amazon.com/blogs/containers/amazon-eks-now-supports-control-plane-egress-through-your-vpc/GitHub self-service credential revocation for incident response https://github.blog/changelog/2026-06-24-self-service-credential-revocation-for-incident-response/AWS Management Console Private Access https://aws.amazon.com/about-aws/whats-new/2026/06/aws-management-console-private/Vercel Connect https://vercel.com/blog/introducing-vercel-connectAmazon S3 annotations https://aws.amazon.com/blogs/aws/amazon-s3-annotations-attach-rich-queryable-context-directly-to-your-objects/Marc Brooker: Waiting, latency, MTTR, and the inspection paradox https://brooker.co.za/blog/2026/06/19/waiting.htmlThis week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W26/More episodes and full show notes https://www.shipitweekly.fm
• 
  Ship It Conversations: Guardsquare’s Joel DeStefano on Mobile App Security, Runtime Protection, App Hardening, and Why Scanning Isn’t Enough 21.06.2026 35min

  This is a guest conversation episode of Ship It Weekly, separate from the weekly news recaps.In this Ship It: Conversations episode, I talk with Joel DeStefano from Guardsquare about mobile app security, why it is different from backend and cloud security, and why scanning alone is not enough once an app is shipped into the real world.We talk about the shift in trust model that happens with mobile apps. In backend and cloud systems, teams usually have more control over the runtime, infrastructure, policies, and monitoring. With mobile, the app becomes a public artifact running on someone else’s device, in an environment you do not fully control.The bigger theme here is that mobile security is not just “scan it before release.” Scanning matters, but teams also need to think about app hardening, obfuscation, runtime protection, monitoring, and whether the app connecting back to their APIs is genuine and uncompromised.Highlights• Why mobile changes the trust model compared to backend and cloud systems• What DevOps, SRE, and platform teams should understand about mobile app risk• Why scanning is useful, but not enough by itself• The danger of assuming app store approval means an app is secure• Why “we do not store sensitive data in the app” can be a misleading security argument• How attackers can reverse engineer apps, inspect workflows, and learn how the app talks to backend APIs• What code hardening and obfuscation actually help protect against• Why runtime checks matter for rooted devices, compromised environments, debuggers, hooking frameworks, overlays, and accessibility abuse• The difference between Android and iOS security assumptions• Why the OS is not responsible for protecting your app’s business logic• How mobile security should fit into CI/CD without destroying release velocity• What should block a release versus what should become tracked risk• Why testing, hardening, runtime protection, and monitoring should work together as one strategy• How AI may speed up attackers without fundamentally changing the need for strong security fundamentals• Joel’s advice for improving mobile security posture: start with the app’s critical workflows, backend interactions, and real business riskJoel / Guardsquare links• Guardsquare: https://hubs.ly/Q04fJgkJ0• Guardsquare Blog: https://www.guardsquare.com/blogOWASP mobile security links• OWASP Mobile Application Security: https://owasp.org/www-project-mobile-app-security/• OWASP MASVS: https://mas.owasp.org/MASVS/Our linksMore episodes + show notes + links: https://shipitweekly.fmOn Call Brief: https://oncallbrief.com
• 
  PeopleSoft Zero-Day Exploited, npm v12 Install Script Changes, GitHub Agentic Tokens, Anthropic Model Risk, and Default Trust Breaking 19.06.2026 22min

  This episode of Ship It Weekly is about default trust getting punished. Brian covers Oracle’s emergency PeopleSoft advisory for CVE-2026-35273, npm v12 changing install-script defaults, GitHub Agentic Workflows moving away from long-lived personal access tokens, and Anthropic disabling Fable 5 and Mythos 5 after a U.S. export-control directive. The common thread: legacy ERP systems, package installs, CI/CD agents, and AI models all become production risks when teams trust the default without checking what that trust can actually do.In the lightning round, Brian covers Tekton CloudEvents moving to a dedicated events controller, NVIDIA Triton Inference Server 26.04 changing inference defaults, AWS Nitro Isolation Engine bringing formal verification to Graviton5-based isolation, and Homebrew 6.0 adding explicit trust for third-party taps. The bigger theme: production does not care why you trusted the default. It only cares what that default was allowed to do.The bigger theme: production does not care why you trusted the default. It only cares what that default was allowed to do.LinksOracle PeopleSoft CVE-2026-35273 advisory https://www.oracle.com/security-alerts/alert-cve-2026-35273.htmlnpm v12 breaking changes https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/GitHub Agentic Workflows no longer need PATs https://github.blog/changelog/2026-06-11-agentic-workflows-no-longer-need-a-personal-access-token/Anthropic Fable 5 / Mythos 5 access statement https://www.anthropic.com/news/fable-mythos-accessTekton Pipelines releases https://github.com/tektoncd/pipeline/releasesNVIDIA Triton Inference Server 26.04 release notes https://docs.nvidia.com/deeplearning/triton-inference-server/release-notes/rel-26-04.htmlAWS Nitro Isolation Engine https://aws.amazon.com/blogs/compute/aws-nitro-isolation-engine-formally-verifying-the-hypervisor-in-the-aws-nitro-system/Homebrew 6.0.0 https://brew.sh/2026/06/11/homebrew-6.0.0/This week’s On Call Brief https://www.tellerstech.com/on-call-brief-news/2026-W25/More episodes and show notes https://shipitweekly.fm/