On Call Brief – Week of July 5–11, 2026

2026-07-05 — 2026-07-11 Briefing: 2026-07-05 Last updated 4 hours ago (Jul 10, 2026 3:53 am EDT) 19 min read
Share
Category:
Tags:

This week's top stories

1. NetNut Proxy Network Disrupted, 2 Million Infected Devices Cut Off

  • Category: Deep Dive
  • What happened: A joint operation involving Google, the FBI, and other partners disrupted the NetNut residential proxy network, which had provided cybercriminals access to millions of compromised Android devices. This operation cut off access to approximately 2 million infected devices, including smart TVs and streaming boxes.
  • Takeaway: The disruption of the NetNut proxy network may affect organizations relying on similar proxy services for legitimate purposes, as well as increase scrutiny on device security and the potential for compromised devices in networks.
  • Source: Security Boulevard (FeedBurner mirror)
  • Tags:

2. Microsoft, Google and Cloudflare just made 2029 the new quantum deadline

  • Category: Community
  • What happened: Microsoft, Google, and Cloudflare have moved the deadline for adopting quantum-safe cryptography from 2030 to 2029, citing advancements in quantum computing that could pose risks sooner than expected. This shift emphasizes the need for organizations to begin preparations for a transition to post-quantum cryptography, which is recognized as a multi-year engineering effort. The urgency is driven by the potential arrival of cryptographically relevant quantum computers, necessitating early action to mitigate risks and costs associated with the transition.
  • Worth reading: Organizations must accelerate their plans for adopting quantum-safe technologies to meet the new 2029 deadline, which could impact security strategies and resource allocation. Delaying preparations could lead to increased risks and costs.
  • Source: The New Stack
  • Tags:

3. Fake Bug Report Shows AI Coding Agents Can Be Turned Into an Enterprise Attack Path

  • Category: Deep Dive
  • What happened: Researchers have identified a new attack method called 'agentjacking' that targets AI coding assistants by embedding malicious instructions within fake bug reports. This technique was tested on AI tools like Claude Code, Cursor, and Codex, which were able to retrieve compromised error logs, potentially exposing enterprises to security risks.
  • Takeaway: This attack vector highlights vulnerabilities in AI coding tools that could be exploited in production environments, necessitating increased scrutiny and security measures around the use of AI in software development.
  • Source: Security Boulevard (FeedBurner mirror)
  • Tags:

4. Upgrade Amazon EKS clusters with confidence using Kubernetes version rollbacks - An undo button for Kubernetes

  • Category: Deep Dive
  • What happened: Amazon EKS now supports Kubernetes version rollbacks, allowing operators to revert to a previous version if an upgrade causes issues. This feature aims to reduce the risks associated with upgrades, which often require extensive preparation and can lead to downtime if not managed carefully.
  • Takeaway: This rollback capability provides a safety net for EKS upgrades, potentially reducing downtime and operational stress during version changes. It allows teams to respond more flexibly to issues that arise post-upgrade.
  • Source: AWS via Last Week in AWS
  • Tags:

5. Cloudflare: 2 service incidents (Issues with network performance in North America, Elevated number of errors in

  • Category: Deep Dive
  • What happened: Cloudflare experienced two separate regional incidents affecting customer traffic between July 3 and July 6, 2025. Network performance issues impacted services across North America starting July 3, with Cloudflare identifying and resolving the problems by July 6 according to their status page. A shorter but more severe incident occurred in Munich, Germany where customers experienced elevated 4XX and 5XX error rates between 05:07 and 05:19 UTC, which was also resolved. Operators using Cloudflare should verify that their services have returned to normal performance levels in these regions and review any alerts or logs from this timeframe to assess potential impact on their applications.
  • Takeaway: This incident may have affected users relying on Cloudflare's services in North America, potentially leading to degraded performance or connectivity issues during the outage period.
  • Sources: Cloudflare Status
  • Tags:

6. ECS Service Connect now supports Zone-Aware routing

  • Category: Community
  • What happened: ECS Service Connect has introduced Zone-Aware routing, allowing traffic to be kept local by default, eliminating the previous charge of one cent per gigabyte for cross-zone traffic. This change aims to enhance resilience without incurring additional costs.
  • Worth reading: This update may reduce costs associated with cross-zone traffic in ECS, potentially impacting service architecture and cost management strategies.
  • Source: Receipts Lastweekinaws via Last Week in AWS
  • Tags:

7. Uncover new performance insights using Amazon detailed performance statistics on Windows

  • Category: Community
  • What happened: Amazon EC2 Windows instances now offer detailed performance statistics for both Amazon EBS and Instance Store, enabling real-time monitoring of key metrics like latency, throughput, and IOPS. This enhancement allows operators to proactively identify and address performance bottlenecks. The new metrics provide sub-minute granularity and can be accessed via the NVMe device attached to the EC2 instance. A sample solution is provided to demonstrate how to use these statistics for monitoring and troubleshooting storage performance, particularly for latency-sensitive applications.
  • Worth reading: The introduction of detailed performance statistics can significantly improve the ability to monitor and optimize storage performance on EC2 Windows instances. This could lead to enhanced application reliability and performance, especially for workloads sensitive to I/O interruptions.
  • Source: AWS Compute Blog
  • Tags:

8. Amazon CloudWatch supports creating alarms from log queries - Alarming on logs without first sacrificing a goat to

  • Category: Community
  • What happened: Amazon CloudWatch now allows users to create alarms directly from log queries, simplifying the process of monitoring logs. However, this feature comes with a caveat: users will incur costs based on the amount of data scanned by these scheduled queries, which could lead to unexpected billing increases during error spikes.
  • Worth reading: This change could affect production monitoring strategies, as operators need to be mindful of query frequency to avoid high costs associated with log data scanning.
  • Source: AWS via Last Week in AWS
  • Tags:

9. How IAG accelerated service-to-service communication with Amazon VPC Lattice

  • Category: Community
  • What happened: IAG implemented Amazon VPC Lattice to enable direct service-to-service communication between microservices without routing traffic through the public internet, eliminating the previous requirement for requests to traverse external networks. Separately, AWS published guidance on enforcing least-privilege authorization in multi-agent AI systems using Cedar, an open-source authorization language that implements a three-layer policy model to prevent unauthorized actions through delegation chains. SRE teams operating microservices architectures should evaluate VPC Lattice for reducing latency and improving security posture in east-west traffic patterns, while teams deploying multi-agent AI systems should review the Cedar authorization framework to implement proper access controls between AI agents. Both solutions address authorization and network security concerns but target different architectural patterns (microservices communication versus AI agent delegation). Source attribution: AWS Networking Blog and AWS Security Blog.
  • Worth reading: This change could significantly reduce latency in service communications, which is crucial for performance-sensitive applications. Operators should consider the implications of adopting VPC Lattice for their own microservices architectures to improve efficiency.
  • Sources: AWS Networking Blog, AWS Security Blog
  • Tags:

10. When TLS 1.3-only broke everything behind Akamai

  • Category: Deep Dive
  • What happened: An incident occurred when requests to a backend nginx server stopped due to a mismatch in TLS policies between Akamai and an External Load Balancer (LB). The LB was set to TLS 1.3 only, while Akamai was configured to negotiate down to older versions. This caused the TLS handshake to fail, leading to the perception of a certificate issue. The resolution involved changing the LB's TLS policy to support both TLS 1.2 and 1.3, restoring traffic flow.
  • Takeaway: This incident highlights the importance of aligning TLS policies between edge services like Akamai and backend load balancers. A mismatch can lead to service outages that may be misdiagnosed as certificate problems. Operators should ensure that any changes to TLS policies are communicated with all relevant stakeholders to prevent similar issues.
  • Source: dev.to (DevOps tag)
  • Tags:

CVE & Security

1. CVE-2026-14471 - Authenticated SQL injection in the metrics-service retention policy subsystem of mcp-gateway-registry

  • Category: Security / Patch
  • What happened: CVE-2026-14471 is a critical SQL injection vulnerability in the metrics-service retention policy subsystem of the Amazon mcp-gateway-registry. An authenticated remote user can exploit this vulnerability by supplying a crafted table_name value, allowing them to execute arbitrary SQL queries against the metrics database. This can lead to unauthorized access to stored data, including sensitive information like API keys, and the ability to delete or modify data.
  • Do this Monday: This vulnerability poses a significant risk to any deployment using affected versions of the mcp-gateway-registry, as it allows authenticated users to manipulate the database, potentially leading to data breaches or loss.
  • Source: AWS Security Bulletins
  • Tags:

2. Novee Uncovers Cordyceps: The Latest Threat to CI/CD Pipelines

  • Category: Security / Patch
  • What happened: Novee has identified a new supply chain security flaw named Cordyceps that poses significant risks to CI/CD pipelines. This vulnerability allows unauthenticated users to hijack workflows and gain control over code repositories of major companies like Microsoft and Google. The flaw exploits weaknesses in CI/CD workflows, which are often not treated as security-critical, leading to potential command injection and credential theft. The rise of AI coding agents further complicates the issue by perpetuating insecure patterns across repositories.
  • Do this Monday: The Cordyceps vulnerability highlights critical security gaps in CI/CD processes that could lead to unauthorized code execution and credential theft. Organizations must reassess their CI/CD security practices to mitigate these risks, especially given the ease of exploitation by unauthenticated users.
  • Source: DevOps.com
  • Tags:

3. Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages

  • Category: Security / Patch
  • What happened: A vulnerability in Opera GX allowed malicious websites to automatically install browser add-ons, enabling data theft from visited pages without user interaction. Researchers demonstrated that they could extract a user's full Gmail address through this exploit. Opera has released a patch for the flaw and reported no evidence of exploitation in the wild.
  • Do this Monday: This vulnerability could have led to unauthorized access to sensitive user data, highlighting the importance of keeping browsers updated and being cautious with add-ons. The patch should be applied to mitigate potential risks.
  • Source: Thehackernews via The Hacker News (security)
  • Tags:

4. PostgreSQL: 42.7.12, 1.30.0, v5.0

  • Category: Security / Patch
  • What happened: The PostgreSQL ecosystem has released three security-focused updates that SRE teams should evaluate for deployment. PostgreSQL JDBC driver version 42.7.12 patches CVE-2026-54291, which allowed silent downgrades from SCRAM-SHA-256-PLUS to weaker authentication by bypassing channel binding requirements during connection establishment. CloudNativePG 1.30.0 introduces a new DatabaseRole Custom Resource Definition for declarative role management and implements lease-based primary election to reduce split-brain scenarios during failover, while also including unspecified security enhancements. The credcheck extension version 5.0 adds PostgreSQL 19 compatibility and password history replication awareness, enabling stricter credential validation rules across replicated environments. Operators using PostgreSQL JDBC connections should prioritize upgrading to 42.7.12 to prevent authentication downgrades, while CloudNativePG users can adopt the new role management CRD and evaluate the lease-based failover mechanism for improved cluster reliability.
  • Do this Monday: This release is critical for users relying on channel binding for secure connections, as it mitigates a significant security risk. Operators should update to version 42.7.12 to ensure protection against potential man-in-the-middle attacks that exploit this vulnerability.
  • Sources: PostgreSQL News
  • Tags:

5. SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing

  • Category: Security / Patch
  • What happened: Researchers have developed a technique called SkillCloak that allows malicious AI agent skills to evade detection by static scanners. This method successfully bypassed over 90% of the tested scanners, highlighting vulnerabilities in current security measures against AI-related threats. The team also created a runtime checker that can identify most of these malicious skills.
  • Do this Monday: This development raises concerns about the effectiveness of existing security measures for AI systems, potentially leading to increased risks of malware in AI applications - operators should consider enhancing their detection capabilities to address these vulnerabilities.
  • Source: Thehackernews via The Hacker News (security)
  • Tags:

6. TuxCare Warns AI Will Weaponize Vulnerability Chains

  • Category: Security / Patch
  • What happened: TuxCare has issued a warning that AI-powered tools will increasingly be used to identify and exploit vulnerability chains, where multiple interconnected vulnerabilities are leveraged in sequence to compromise systems through automated attacks. The security vendor emphasizes that traditional single-vulnerability patching approaches may prove insufficient against AI-driven attacks that can rapidly discover and chain together multiple weaknesses across software stacks. Operators should prioritize comprehensive vulnerability management strategies that consider dependency chains and interconnected systems rather than treating vulnerabilities in isolation, and evaluate their current patch management workflows to ensure they can respond quickly to multi-stage attack scenarios. According to Techstrong.ai reporting on TuxCare's analysis, this shift toward AI-weaponized vulnerability chains represents a fundamental change in threat modeling that will require enhanced security measures across both software development and infrastructure management practices.
  • Do this Monday: This warning suggests that organizations should reassess their vulnerability management strategies and consider the implications of AI in threat landscapes. Increased vigilance and proactive security measures may be necessary to defend against sophisticated attacks.
  • Sources: Techstrong.ai
  • Tags:

Releases

1. China-Linked Threat Group Expands Attacks on Southeast Asia’s Critical Infrastructure

  • Category: Release
  • What happened: Cybersecurity researchers have identified a China-linked threat group, CL-STA-1062, that is now targeting critical infrastructure organizations in Southeast Asia, including electricity and water providers, as well as government entities. This marks a shift from their previous focus on web-hosting infrastructure in Taiwan.
  • Do this Monday: Increased attacks on critical infrastructure could lead to potential disruptions in services and heightened security risks for organizations in Southeast Asia. Operators should assess their security posture and readiness against such targeted threats.
  • Source: Security Boulevard (FeedBurner mirror)
  • Tags:

2. Your Worker can now have its own cache in front of it

  • Category: Release
  • What happened: Cloudflare has launched Workers Cache, a new tiered caching layer that sits in front of Cloudflare Workers to serve cacheable requests directly from Cloudflare's cache infrastructure without executing Worker code. This feature is designed to reduce CPU usage charges and improve response times for applications with cacheable content by preventing unnecessary Worker invocations for repeated requests. SRE teams running Workers-based applications should evaluate their current caching strategy and configure Workers Cache for appropriate endpoints to optimize both performance and operational costs. Configuration details and implementation guidance are available in the official Cloudflare Blog announcement.
  • Do this Monday: The introduction of Workers Cache can significantly improve performance and reduce costs for applications using Cloudflare Workers. By caching responses at the edge, it minimizes the need for Workers to execute for cacheable requests, which can lead to lower CPU time and faster response times for users.
  • Sources: Cloudflare Blog, Blog Cloudflare via TLDR DevOps
  • Tags:

3. Insignary Closes SBOM Accuracy Gap With Binary-Level Clarity for Regulatory Risk

  • Category: Release
  • What happened: Insignary has introduced a binary-first platform called Insignary Clarity that enhances software composition analysis (SCA) by analyzing the actual binaries deployed rather than just the declared components. This approach addresses the growing concern over unmanaged open-source dependencies and the accuracy of Software Bills of Materials (SBOMs), which are becoming regulatory requirements. The platform aims to provide better visibility into vulnerabilities and compliance risks associated with open-source components, especially in AI-generated code environments.
  • Do this Monday: The introduction of Insignary Clarity could significantly affect how organizations manage their software supply chains and compliance with emerging regulations around SBOMs. By validating software at the binary level, teams can better understand and mitigate risks associated with open-source components, which is crucial as regulatory scrutiny increases.
  • Source: DevOps.com
  • Tags:

4. Claude Reaches GA on Microsoft Foundry: European Enterprises Cannot Deploy It

  • Category: Release
  • What happened: Claude models are now generally available on Microsoft Foundry, featuring Azure-native billing and governance. However, there is no European data zone available, which means that European enterprises, particularly in regulated sectors like banking and healthcare, cannot deploy it for production use due to data residency concerns.
  • Do this Monday: The lack of a European data zone for Claude models on Microsoft Foundry limits deployment options for organizations in Europe, especially those in regulated industries that require strict data residency compliance.
  • Source: InfoQ DevOps
  • Tags:

Also this week

Community reads

11. Cloudflare launched Workers Cache, a tiered caching system that sits in front of Workers and can eliminate CPU

  • Category: Community
  • What happened: Cloudflare has launched Workers Cache, a new tiered caching system that sits in front of Workers to serve cached responses before invoking Worker execution. This architecture change is designed to eliminate CPU charges for cache hits, directly reducing costs for applications that can leverage caching while also improving response times. Operators using Cloudflare Workers for applications with cacheable content should evaluate implementing Workers Cache to optimize both performance and billing, particularly for read-heavy workloads. The system represents a shift from the previous model where every request triggered Worker CPU consumption regardless of cacheability.
  • Worth reading: The introduction of Workers Cache could significantly lower operational costs for applications relying on Cloudflare Workers by reducing CPU usage. This change may affect how developers optimize their serverless functions and manage caching strategies.
  • Sources: Atlassian via TLDR DevOps
  • Tags:

12. Cloudflare launched Workers Cache, a tiered caching system that sits in front of Workers and can eliminate CPU

  • Category: Community
  • What happened: Cloudflare has introduced Workers Cache, a new tiered caching system that operates in front of Cloudflare Workers to serve cached responses before invoking Worker execution. The primary benefit for operators is reduced CPU consumption and associated costs, as requests can be served directly from cache without triggering billable Worker invocations. Organizations currently using Cloudflare Workers should evaluate implementing Workers Cache to optimize their infrastructure costs, particularly for workloads with cacheable content or repetitive request patterns. This feature represents a straightforward optimization opportunity that can deliver immediate cost savings without requiring significant application refactoring.
  • Worth reading: The introduction of Workers Cache could significantly impact performance and cost management for applications using Cloudflare Workers by reducing CPU charges through effective caching.
  • Sources: Pgdog via TLDR DevOps, Spacelift via TLDR DevOps, GitHub via TLDR DevOps
  • Tags:

Lightning links

Human Stories

Looking at NetNut's takedown alongside the agentjacking research, I'm struck by how much of our security posture now depends on trusting intermediaries we can barely see - proxy networks that promise privacy, AI assistants that promise productivity, cloud providers promising quantum-safe futures by 2029. The good news from AWS this week, the EKS rollback feature and ECS zone-aware routing, represents something refreshingly tangible: infrastructure teams acknowledging that we need escape hatches and cost-conscious defaults, not just forward momentum. When Cloudflare has regional incidents affecting North America and it makes our briefing, it's a reminder that even the giants stumble, and the real maturity isn't in never failing but in having rolled back your Kubernetes upgrade before anyone had to write a postmortem. We're building on layers of abstraction that sometimes feel precarious, but at least we're finally getting tooling that admits things go wrong and gives us a way back.

Also worth reading

Safely Releasing Frontier Models to Customers - A frontier model got so good at finding vulnerabilities that (Last Week in AWS)

A frontier model developed by Amazon became highly effective at identifying vulnerabilities, leading to concerns that prompted a call to the White House, resulting in its temporary withdrawal. The model has now been reintroduced with hopes that the incident will be forgotten.

The Supreme Court Just Put Limits on Geofence Warrants (Security Boulevard (FeedBurner mirror))

The Supreme Court has ruled that constitutional privacy protections apply to cellphone location history and geofence warrant data. This ruling limits the ability of law enforcement to access location data that can include information from many individuals in a given area, not just specific suspects.

GitLab CI skill for ai agents based on official docs (Reddit r/devops)

An engineer discusses their experience using AI agents to assist with GitLab CI pipeline creation and refactoring. They found existing AI skills unreliable and decided to create their own, which is based on official GitLab documentation. The skill addresses pipeline structure, debugging, and other c
Kubernetes News Cloud News DevOps Security News CI/CD News SRE News Platform Engineering News
Scroll to Top