On Call Brief – Week of August 16–22, 2026

2026-08-16 — 2026-08-22 Briefing: 2026-08-16 Published 3 weeks ago (Aug 23, 2026 6:00 am EDT) 19 min read
Share
Category:
Tags:

This week's top stories

1. GitHub Hit by Widespread Outage, Halting Work for Global Developers

  • Category: Deep Dive
  • What happened: GitHub experienced a multi-hour global outage on Monday morning starting around 9:40 a.m. EDT, with error rates reaching 20% for web and API traffic and nearly 50% for core services, impacting millions of developers worldwide. According to GitHub's incident report, the root cause was an autoscaling misconfiguration in an Istio sidecar pod that caused network saturation of load balancers, with recovery efforts complicated by aggressive retry logic and a bug in VS Code that amplified the load. SRE teams should review their own service mesh autoscaling configurations to prevent similar cascading failures, particularly examining Istio sidecar pod scaling parameters and implementing rate limiting or backoff strategies to prevent client retry storms from impeding recovery. Organizations heavily dependent on GitHub should ensure they have documented procedures for working during GitHub outages and consider maintaining local mirrors of critical repositories if business continuity requires it.
  • Takeaway: This outage impacted critical development workflows, particularly at the start of the week when many teams begin their sprints. The high error rates in core functionalities could lead to delays in software deployment and testing, affecting productivity across teams relying on GitHub services.
  • Sources: DevOps.com, Githubstatus via TLDR Dev
  • Tags:

2. Anthropic confirms Claude is down in major outage affecting multiple services

  • Category: Deep Dive
  • What happened: Anthropic's Claude AI service experienced a significant outage causing login failures and degraded performance across multiple services. Separately, ElevenLabs has released a hosted Model Context Protocol (MCP) connector that enables Claude to directly manage production voice agents, including potentially destructive operations like deletion, without requiring access to the ElevenLabs dashboard. Operators using the ElevenLabs MCP connector should implement appropriate access controls and approval workflows, as Claude can now modify or delete production voice agents directly from chat interactions. During the Claude outage, teams should monitor Anthropic's status page for resolution updates and have fallback procedures in place for critical AI-dependent workflows. The combination of service instability and new production-management capabilities highlights the need for robust safeguards around AI system access to production infrastructure.
  • Takeaway: This outage may affect any services relying on Claude, potentially disrupting operations and user access.
  • Sources: Bleeping Computer, The New Stack
  • Tags:

3. New AmnesiaStealer macOS malware hijacks browser sessions via remote control

  • Category: Deep Dive
  • What happened: AmnesiaStealer is a new malware targeting macOS users that employs ClickFix attacks to hijack browser sessions. It features a streaming module enabling attackers to interactively control the victim's web browser, posing a significant security risk.
  • Takeaway: This malware could lead to unauthorized access to sensitive information and accounts, making it crucial for operators to ensure security measures are in place for macOS environments.
  • Source: Bleeping Computer
  • Tags:

4. Large-scale DDoS attacks disrupted Threema secure messaging service

  • Category: Deep Dive
  • What happened: Threema, a secure messaging service, experienced severe disruptions due to multiple large-scale DDoS attacks earlier this week. The attacks impacted the availability of the service, affecting user communications.
  • Takeaway: DDoS attacks on Threema highlight the vulnerability of secure messaging services to such threats - operators should consider reviewing their DDoS mitigation strategies to protect against similar incidents.
  • Source: Bleeping Computer
  • Tags:

5. Zenity Labs: PleaseFix Vulnerability in Agentic Browsers

  • Category: Community
  • What happened: Zenity Labs has identified a vulnerability named PleaseFix in Agentic Browsers, which could potentially expose user data and compromise security. The report details the nature of the vulnerability and its implications for users and organizations relying on these browsers.
  • Worth reading: This vulnerability could affect production environments using Agentic Browsers, necessitating immediate attention to mitigate potential data exposure risks.
  • Source: Zenity via TLDR AI
  • Tags:

6. AWS Certificate Manager will discontinue email validation to prove domain validation for certificates

  • Category: Community
  • What happened: AWS Certificate Manager will stop supporting email validation for domain validation of certificates, pushing users to adopt DNS validation instead. This change is driven by an industry group rather than AWS itself, and while it is seen as a positive shift, it may pose challenges for those who have not yet transitioned to DNS validation.
  • Worth reading: Organizations relying on email validation for certificate issuance will need to switch to DNS validation, which may require updates to their domain management practices and could disrupt existing workflows.
  • Source: AWS via Last Week in AWS
  • Tags:

7. Certificate Expiry Is Still Taking Down Major Platforms

  • Category: Deep Dive
  • What happened: The article discusses the ongoing issue of TLS certificate expirations causing outages for major platforms. It highlights recent incidents where expired certificates led to significant downtime, emphasizing the need for better monitoring and management of certificate lifecycles.
  • Takeaway: Expired TLS certificates continue to disrupt services, indicating a need for improved monitoring and alerting systems to prevent outages caused by certificate expiry.
  • Source: Tokentimer Ch via SRE Weekly
  • Tags:

8. Cloudflare: 11 scheduled maintenance windows (Chicago, Montréal, Berlin, Hong Kong (+7 more))

  • Category: Community
  • What happened: Cloudflare has scheduled coordinated datacenter maintenance across multiple facilities between August 17-19, 2026. The TXL (Berlin) maintenance window already occurred on August 17 from 00:00-04:00 UTC, while ORD (Chicago) and YUL (Montréal) maintenance is scheduled for August 17 from 08:00-11:00 UTC and 08:00-12:00 UTC respectively, with additional windows planned for DAC (Dhaka), SJC (San Jose), HKG (Hong Kong), AMS (Amsterdam), ATL (Atlanta), IAD (Ashburn), and MAD (Madrid) through August 19. During these maintenance periods, traffic will be re-routed to other datacenters which may result in increased latency for end-users in affected regions, and customers using Private Network Interconnect (PNI) or Cloudflare Network Interconnect (CNI) should prepare for possible connectivity impacts. Operators should monitor application latency metrics during these windows and consider pre-warming caches or adjusting failover thresholds if their traffic predominantly routes through any of these facilities.
  • Worth reading: Operators should anticipate increased latency and possible traffic rerouting during the maintenance window. PNI/CNI customers need to ensure their systems can handle failover due to potential unavailability of network interfaces.
  • Sources: Cloudflare Status
  • Tags:

9. Unlocking real-time analytics: Streaming Aurora DSQL changes into Apache Iceberg

  • Category: Community
  • What happened: This article discusses how to stream change data capture (CDC) events from Amazon Aurora DSQL into Apache Iceberg tables using AWS Glue and Amazon Data Firehose. It details the setup for maintaining two Iceberg tables: one for an append-only audit trail of CDC events and another for the current state of data, which handles updates and deletions using tombstone flags. The piece highlights the benefits of real-time analytics and event-driven applications without impacting operational performance.
  • Worth reading: The introduction of CDC support in Amazon Aurora DSQL allows for real-time data streaming, which can enhance analytics capabilities and data synchronization across systems. This change may require adjustments in data architecture and operational practices to leverage the new features effectively.
  • Source: AWS Database Blog
  • Tags:

10. Kubernetes NetworkPolicy Checklist: Locking Down Namespace Isolation

  • Category: Community
  • What happened: The article discusses the importance of implementing Kubernetes NetworkPolicies for namespace isolation to prevent lateral movement between pods. It highlights a common oversight where teams fail to apply a default-deny-all policy, leaving all pods accessible to each other. The author provides a checklist for establishing proper isolation, including steps for default-deny ingress and egress, allowing DNS egress, and managing intra-namespace traffic. The checklist aims to ensure that Kubernetes networking is secure and compliant with best practices.
  • Worth reading: Failure to implement proper NetworkPolicies can lead to security vulnerabilities, allowing compromised pods to access sensitive services. This checklist serves as a guide to mitigate such risks and ensure compliance with security standards.
  • Source: dev.to (Kubernetes tag)
  • Tags:

CVE & Security

11. CVE-2026-59124 Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability

  • Category: Security / Patch
  • What happened: Microsoft has released a security update addressing a remote code execution vulnerability in the High Performance Computing (HPC) Pack. Users are advised to install the update promptly to mitigate potential risks.
  • Do this Monday: This vulnerability could allow attackers to execute arbitrary code on affected systems, posing a significant security risk. Immediate patching is recommended to protect production environments.
  • Source: Microsoft MSRC Security Update Guide
  • Tags:

12. RHSA-2026:55442: Important: bind9.18 security update

  • Category: Security / Patch
  • What happened: An important security update for bind9.18 is now available for Red Hat Enterprise Linux 9. This update has been rated as having a significant security impact, with detailed severity ratings provided through the CVSS base score linked to the associated CVEs.
  • Do this Monday: This update addresses vulnerabilities in bind9.18 that could affect the security posture of systems running Red Hat Enterprise Linux 9 - operators should prioritize applying this update to mitigate potential risks.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

13. RHSA-2026:55432: Important: curl security update

  • Category: Security / Patch
  • What happened: An important security update for curl has been released for Red Hat Enterprise Linux 10. The update addresses vulnerabilities rated as having a significant security impact, with detailed severity ratings available through the CVE links provided.
  • Do this Monday: This update may require immediate attention to ensure that curl installations on Red Hat Enterprise Linux 10 are patched against known vulnerabilities, which could affect system security.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

14. RHSA-2026:55439: Important: curl security update

  • Category: Security / Patch
  • What happened: An important security update for curl is now available for Red Hat Enterprise Linux 9. This update has been rated as having a significant security impact, with detailed severity ratings provided via the CVE links.
  • Do this Monday: This update may require immediate attention to mitigate potential security risks associated with curl in production environments.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

15. Wireshark 4.6.8 Released, (Sun, Aug 16th)

  • Category: Security / Patch
  • What happened: Wireshark version 4.6.8 has been released, addressing 28 vulnerabilities and 25 bugs. This update is crucial for maintaining security and stability in network analysis.
  • Do this Monday: The release includes critical security fixes that may affect network monitoring and analysis tools in production environments - operators should update to mitigate vulnerabilities.
  • Source: SANS ISC
  • Tags:

16. Make zero CVEs your new default

  • Category: Security / Patch
  • What happened: Docker emphasizes the importance of securing the software supply chain in light of increasing supply-chain attacks. The company has introduced Docker Hardened Images, which are built and patched by Docker, ensuring a secure baseline for developers. These images are compatible with popular distributions and come with independently verifiable software bills of materials (SBOMs) and provenance. The catalog of hardened images has surpassed 4,000, with significant weekly usage, highlighting the need for robust security practices in modern development environments.
  • Do this Monday: The introduction of Docker Hardened Images could significantly reduce vulnerabilities in production environments by providing a secure baseline for container images. This shift towards a more secure supply chain is crucial as the volume of third-party code increases, making it essential for teams to adopt these hardened images to mitigate risks associated with supply-chain attacks.
  • Source: Docker Blog
  • Tags:

Releases

17. Microsoft blames AI for delayed Exchange update, can’t say when it will arrive

  • Category: Release
  • What happened: Microsoft has announced a delay in the release of the Cumulative Update 1 (CU1) for Exchange Server Subscription Edition due to additional work caused by AI tools used for bug-finding. The company has not provided a specific release date, citing the need to prioritize security and ensure that the update is stable. This delay raises concerns for Exchange administrators who rely on timely updates to maintain their systems.
  • Do this Monday: The delay in CU1 for Exchange SE could affect organizations relying on timely updates for security and functionality. Administrators may face challenges in managing updates if they are not released as expected, potentially leading to increased workload and security risks.
  • Source: The Register (Software)
  • Tags:

18. Amazon Aurora DSQL observability concepts and usage with Amazon CloudWatch

  • Category: Release
  • What happened: Amazon Aurora DSQL has introduced enhanced observability features through Amazon CloudWatch Database Insights, which provide time-based performance diagnostics linked to operational costs. The observability model focuses on understanding where time is spent during database operations, which is crucial for managing costs in the on-demand pricing model of DSQL. The DSQL Active Session History (DASH) monitors session activity and publishes aggregated data to CloudWatch, helping users identify performance bottlenecks and optimize resource usage. This feature is enabled by default for all Aurora DSQL clusters at no extra cost.
  • Do this Monday: The new observability features in Aurora DSQL can help operators optimize database performance and manage costs more effectively. Understanding session activity and performance metrics can lead to better resource allocation and reduced billing due to the on-demand pricing model.
  • Source: AWS Database Blog
  • Tags:

19. Dynatrace Acquires Arize as AI Agents Deepen the Observability Challenge

  • Category: Release
  • What happened: Dynatrace has announced its acquisition of AI observability company Arize for $915 million. This acquisition aims to enhance Dynatrace's capabilities in AI observability, allowing for better correlation of telemetry data from AI systems with application and infrastructure data. The integration of Arize's tools, which track AI model behavior and outputs, with Dynatrace's existing platform is expected to streamline the debugging process for SRE and platform teams by providing a clearer trail of agent actions and their impacts on production environments. The deal is anticipated to close soon, further emphasizing the growing demand for AI observability as AI systems become more prevalent in production.
  • Do this Monday: The acquisition could lead to improved observability for AI systems, which may affect how SRE and platform teams monitor and debug AI-related issues in production. As AI agents become more integrated into operations, having a unified view of their behavior and the surrounding infrastructure will be crucial for maintaining system reliability and accountability.
  • Source: DevOps.com
  • Tags:

20. Cloudflare Turns CI Pipelines into TypeScript Workflows

  • Category: Release
  • What happened: Cloudflare has introduced cloudflare/ci, a CI SDK that allows users to define CI pipelines using TypeScript within Cloudflare Workflows. This SDK offers features like durable retries, concurrent steps, and Sandbox snapshot caching. It is designed for the Workers runtime and relies on Artifacts, which is currently in private beta. The key takeaway is the durable-step model rather than a direct CI replacement.
  • Do this Monday: This release could affect teams using Cloudflare for CI/CD by providing a new way to define workflows, potentially improving reliability and efficiency in pipeline execution. However, as it is still in beta, organizations should evaluate its readiness for production use.
  • Source: InfoQ DevOps
  • Tags:

Also this week

Community reads

21. DevOps'ish 322: Linux wireless shuts the door on AI slop patches, KYAML fixes the Norway Bug, and more

  • Category: Community
  • What happened: KYAML, a strict subset of YAML designed to eliminate parsing ambiguities like the Norway Bug (where "NO" is interpreted as boolean false instead of the country code), is entering beta and will become the default in Kubernetes 1.35. The specification enforces consistent formatting by requiring double-quoted strings and using braces and brackets for structural elements, preventing the type coercion issues that have plagued standard YAML parsers. Operators should prepare for this transition by reviewing their Kubernetes manifests and testing them against KYAML validators before the 1.35 release to identify any configurations that rely on implicit type conversion or loose syntax. In related news, Linux Wireless maintainer Johannes Berg has announced plans to disregard AI-generated patches, citing quality concerns with automated contributions.
  • Worth reading: The introduction of KYAML could affect how Kubernetes YAML files are written and parsed, potentially improving reliability. The stance against AI-generated patches in Linux Wireless highlights ongoing debates about code quality and maintenance, which could influence how teams approach code contributions and reviews. Understanding these shifts is crucial for maintaining high standards in production environments.
  • Sources: DevOps'ish
  • Tags:

22. Burst to Region: Overflow AWS Outposts workloads to Amazon EC2

  • Category: Community
  • What happened: AWS has released several operational improvements for SRE teams managing hybrid and cloud infrastructure. AWS Outposts now supports bursting workloads to Amazon EC2 regions during traffic spikes, allowing operators to handle demand beyond local Outposts capacity, though this capability requires additional configuration and may incur higher costs for cross-location traffic. Amazon S3 has improved troubleshooting by including exact ARNs in access denied error messages for explicit deny cases, while generic messages still appear when no policy permits access. AWS IAM Identity Center added a one-click multi-Region setup option for new organization instances (simplifying what was previously a manual process), and Amazon EC2 introduced application-level status checks that function similarly to existing load balancer health checks. Operators using Outposts should evaluate burst-to-region configurations for capacity planning, while those managing S3 permissions can leverage the enhanced error messages for faster debugging.
  • Worth reading: This change may affect production by allowing for better resource allocation and management, particularly for workloads that exceed local capacity. Operators should consider how this integration could optimize their infrastructure.
  • Sources: AWS via Last Week in AWS
  • Tags:

23. Streamline your GitHub journey with AWS CodePipeline and AWS DevOps Agent

  • Category: Community
  • What happened: AWS DevOps Agent streamlines the investigation of CI/CD deployment failures for GitHub-hosted applications by automatically correlating pipeline failures with specific code changes. This integration reduces the time engineers spend manually tracing errors across multiple AWS services and logs, thereby improving software delivery velocity. The solution provides end-to-end visibility and remediation guidance, shifting from manual triage to automated incident investigation within existing GitHub workflows.
  • Worth reading: This tool can significantly reduce mean time to resolution (MTTR) for deployment failures, which is crucial for maintaining deployment velocity and reliability in production environments. Teams using GitHub and AWS services may find this integration particularly beneficial for enhancing their CI/CD processes.
  • Source: AWS DevOps Blog
  • Tags:

24. Xen Project gets serious about safety in push to possibly partition robot brains

  • Category: Community
  • What happened: The Xen Project is focusing on formal safety standards like IEC-61508 to enhance its hypervisor for use in safety-critical applications, such as automotive and robotics. This initiative aims to ensure workload isolation, preventing non-critical applications from affecting critical systems. A new Safety Committee has been formed with contributions from AMD, EPAM, and Renesas, alongside a new membership tier for organizations seeking functional safety certifications. Recent updates to the hypervisor include support for AMD Zen 5 and improved Arm and RISC-V support.
  • Worth reading: This push towards formal safety standards may affect production environments that rely on Xen for virtualization in safety-critical applications. Operators should be aware of the potential for improved reliability and compliance in systems using Xen, particularly in automotive and robotics sectors.
  • Source: The Register (Software)
  • Tags:

Human Stories

When GitHub goes down for millions of developers and Claude stops responding to thousands of users, we're reminded that no amount of engineering sophistication makes you immune to the fundamentals coming back to bite you. The AWS Certificate Manager pushing everyone off email validation and yet another article about certificate expiry taking down major platforms tells us something uncomfortable - we've built increasingly complex systems on top of authentication and identity primitives that still feel like they're held together with duct tape and cronjobs. What strikes me about this week isn't the DDoS attacks on Threema or even the new AmnesiaStealer malware, it's how many of these incidents trace back to trust boundaries we thought we'd solved: certificates we forgot to renew, sessions we didn't protect well enough, validation methods we're only now realizing were never that secure. Maybe the real story here is that as we race toward agentic AI and ever-more-distributed systems, we're discovering that the boring stuff - certificate lifecycle management, session security, basic authentication hygiene - isn't just still relevant, it's becoming the weak point that brings down everything else we've built on top of it.

Also worth reading

Mario Saved the EU but Broke My System (SRE Weekly)

The article reflects on an incident where a system failure occurred due to changes made in response to a broader regulatory requirement, highlighting the unintended consequences of compliance efforts. It discusses the balance between regulatory compliance and operational stability.

Flock ALPR Expansion Raises Privacy Concerns in Traffic Enforcement (Security Boulevard)

The article discusses the use of Flock cameras and automated license plate readers (ALPRs) in public safety and traffic enforcement. It highlights concerns over the expansion of surveillance from finding stolen vehicles to everyday traffic enforcement, emphasizing issues like data retention, sharing
Kubernetes News Cloud News DevOps Security News CI/CD News SRE News Platform Engineering News