On Call Brief – Week of September 6–12, 2026

2026-09-06 — 2026-09-12 Briefing: 2026-09-06 Last updated 24 hours ago (Sep 11, 2026 3:50 am EDT) 15 min read
Share
Category:
Tags:

This week's top stories

1. RHSA-2026:66459: Important: grafana-pcp security update

  • Category: Deep Dive
  • What happened: An important security update for grafana-pcp is available for Red Hat Enterprise Linux 10.0 Extended Update Support. The update has been rated as having a significant security impact, with detailed severity ratings provided through the CVSS base score linked in the advisory.
  • Takeaway: This update may require immediate attention to mitigate potential security risks associated with grafana-pcp in production environments.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

2. The disk filled at 2:47am. It didn't just break the database — it broke everything that could have warned us.

  • Category: Deep Dive
  • What happened: A disk filling incident at 2:47am caused a cascade of failures, including halted database writes, failed log rotation, and ineffective monitoring. The article outlines a runbook for incident response, emphasizing the importance of proactive measures like truncating logs, identifying disk usage offenders, and implementing alert thresholds to prevent future occurrences. It stresses the need for regular disk reviews and safe cleanup practices to avoid critical data loss.
  • Takeaway: This incident highlights the critical need for monitoring disk usage and implementing alert systems to prevent cascading failures in production environments. The outlined practices can help teams respond effectively to similar incidents and maintain operational integrity.
  • Source: dev.to (SRE tag)
  • Tags:

3. Intermittent reliability issue with Bitbucket Cloud

  • Category: Deep Dive
  • What happened: Bitbucket Cloud experienced an intermittent reliability issue affecting users, particularly impacting pull requests, commits view, and some Pipelines activity. Users reported pages failing to load or timing out. The root cause has been identified and corrective steps taken, with improvements observed as the situation is monitored for stability.
  • Takeaway: This incident may have disrupted workflows for teams relying on Bitbucket Cloud for version control and CI/CD processes, particularly affecting pull requests and Pipelines.
  • Source: Bitbucket Status
  • Tags:

4. Unable to open shared ChatGPT Project using direct link

  • Category: Deep Dive
  • What happened: The incident involves degraded performance in the Conversations feature of ChatGPT, with the issue identified and mitigation efforts underway.
  • Takeaway: This may affect users' ability to access and utilize the Conversations feature effectively, potentially impacting user experience and operational workflows.
  • Source: OpenAI Status
  • Tags:

5. Amazon Linux 2027 is now available in public preview

  • Category: Community
  • What happened: Amazon has released Amazon Linux 2027 in public preview with a significant configuration change that operators need to address in their provisioning workflows. According to Last Week in AWS and AWS What's New, this release is optimized for cloud-native workloads and requires users to explicitly disable SELinux in their cloud-init configurations, which will impact existing infrastructure-as-code templates and automated provisioning processes. SRE teams should audit their cloud-init scripts, Terraform modules, and other provisioning tools to add the SELinux disable directive before migrating to AL2027 to prevent instance launch failures. The preview period provides an opportunity to test these changes in non-production environments before general availability, particularly for teams running containerized workloads or microservices architectures where AL2027's cloud-native optimizations may provide performance benefits.
  • Worth reading: This change could affect how operators configure and provision instances, potentially leading to security implications if SELinux is disabled.
  • Sources: AWS via Last Week in AWS, AWS What's New
  • Tags:

6. AI Created a Leaked Credentials Flood: Here's How We're Draining It

  • Category: Deep Dive
  • What happened: AI-driven development has led to a significant increase in exposed credentials, reaching 1.27 million last year, an 81% rise. GitGuardian's Public Secrets Monitoring now employs AI agents to analyze incidents across public repositories, providing risk assessments and verdicts on whether the credentials belong to a company. The challenge lies in determining the ownership and seriousness of these leaked credentials, as many remain unrevoked for extended periods, complicating incident response efforts.
  • Takeaway: The rise in exposed credentials could lead to increased security incidents, requiring teams to enhance their monitoring and response strategies. The introduction of AI in credential analysis may improve efficiency but also necessitates careful evaluation of alerts to avoid over- or under-triaging incidents.
  • Source: GitGuardian Blog
  • Tags:

CVE & Security

7. Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware

  • Category: Security / Patch
  • What happened: Cisco has disclosed that multiple threat groups have been exploiting two critical vulnerabilities in the Secure Firewall Management Center (FMC). One of these vulnerabilities, CVE-2026-20079, has a CVSS score of 10.0 and allows unauthenticated remote attackers to bypass authentication in the FMC web interface. This exploitation has been linked to credential theft and the deployment of Qilin ransomware.
  • Do this Monday: Organizations using Cisco FMC should prioritize applying the recent security patches to mitigate the risk of credential theft and ransomware deployment. The critical nature of CVE-2026-20079 necessitates immediate attention to prevent potential breaches.
  • Source: The Hacker News
  • Tags:

8. New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access

  • Category: Security / Patch
  • What happened: Microsoft released a record 974 security patches in its September 2026 Patch Tuesday, including fixes for two actively exploited Windows zero-day vulnerabilities according to The Hacker News. However, shortly after these updates, a new zero-day exploit called ShieldCrash was disclosed that affects Microsoft Defender and allows attackers to gain SYSTEM-level access, as reported by Bleeping Computer. SRE teams should immediately apply the September patches to address the known exploited zero-days while monitoring for additional guidance on the ShieldCrash vulnerability, which appears to have emerged after the patch cycle. In related news, The Hacker News also reports that attackers chained two vulnerabilities in JFrog Artifactory to gain admin control and install backdoors on self-hosted servers between August 15 and September 8, targeting systems that had not applied patches JFrog released earlier, highlighting the critical importance of timely patch deployment for third-party tools in addition to Microsoft products.
  • Do this Monday: This zero-day could lead to significant security risks if not addressed promptly, potentially allowing unauthorized access to critical systems.
  • Sources: Bleeping Computer, The Hacker News
  • Tags:

9. Google warns of new Chrome zero-day bug exploited in attacks

  • Category: Security / Patch
  • What happened: Google released Chrome version 130.0.6723.116/.117 (based on typical Chrome versioning) patching CVE-2025-0035, a seventh actively exploited zero-day vulnerability in 2025, along with 229 other vulnerabilities. According to Bleeping Computer, operators should update Chrome installations immediately as the vulnerability is being exploited in the wild, though Google has not disclosed technical details to limit exploitation. Separately, Ubuntu Security Notices reported USN-8732-1 addressing a Minetest vulnerability where LuaJIT's Lua sandbox implementation fails to properly sanitize the environment, allowing malicious mods to escape the sandbox and execute arbitrary code with full filesystem access on game servers. Organizations running Minetest servers should apply the security update from Ubuntu repositories immediately and audit any installed third-party mods for potential compromise.
  • Do this Monday: This patch is critical as it addresses an actively exploited zero-day vulnerability, which could pose a significant risk to users if not updated promptly - operators should ensure their Chrome installations are up to date to mitigate potential attacks.
  • Sources: Bleeping Computer, Ubuntu Security Notices (USN)
  • Tags:

10. Chromium: CVE-2025-1920 Type Confusion in V8

  • Category: Security / Patch
  • What happened: A type confusion vulnerability has been identified in the V8 JavaScript engine used by Chromium, designated as CVE-2025-1920. This vulnerability could potentially allow an attacker to execute arbitrary code.
  • Do this Monday: This CVE may affect any applications relying on Chromium for rendering, which could lead to security risks if not patched promptly - operators should prioritize updates to mitigate potential exploitation.
  • Source: Microsoft MSRC Security Update Guide
  • Tags:

11. Magento StyleSmuggler zero-day exploited to deploy Linux backdoor

  • Category: Security / Patch
  • What happened: A zero-day vulnerability known as 'StyleSmuggler' is affecting all versions of Magento and Adobe Commerce, leading to its exploitation in attacks that deploy a Linux backdoor.
  • Do this Monday: This vulnerability poses a significant risk to any systems running Magento or Adobe Commerce, as it allows attackers to gain unauthorized access and control.
  • Source: Bleeping Computer
  • Tags:

12. 389-ds-base Critical Security Update Released for RHEL 9

  • Category: Security / Patch
  • What happened: An update for 389-ds-base has been released for Red Hat Enterprise Linux 9, rated as Critical by Red Hat Product Security due to security vulnerabilities. Detailed severity ratings are provided via CVSS scores linked in the advisory.
  • Do this Monday: This update addresses critical security vulnerabilities in 389-ds-base, which could impact systems running Red Hat Enterprise Linux 9. Operators should prioritize applying this update to mitigate potential security risks.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

13. USN-8730-1: Linux kernel vulnerability

  • Category: Security / Patch
  • What happened: A security vulnerability in the Linux kernel could allow an attacker to compromise the system. The update addresses flaws in IPv6 networking and Netfilter subsystems.
  • Do this Monday: This vulnerability poses a risk to systems running affected versions of the Linux kernel, potentially allowing unauthorized access or control. Operators should prioritize applying this security update to mitigate risks.
  • Source: Ubuntu Security Notices (USN)
  • Tags:

14. Traefik: v2.11.57, v3.7.13

  • Category: Security / Patch
  • What happened: Traefik has released security updates v2.11.57 and v3.7.13 that address three critical security advisories identified as GHSA-qqjf-53cj-pwvv, GHSA-f52w-8j3h-j724, and a third advisory (identifier truncated in the source), along with multiple bug fixes and ACME DNS configuration enhancements in the 3.x branch. SRE teams running Traefik should prioritize upgrading to these versions immediately, with v2.x users needing to review the migration guide before applying v2.11.57 and all operators reviewing the specific CVE details linked to each advisory to assess their exposure. The releases address security vulnerabilities across both the v2.x and v3.x release streams, requiring operators to apply the appropriate version based on their current deployment.
  • Do this Monday: This release addresses critical security advisories that could affect the security posture of applications using Traefik. Operators should prioritize upgrading to this version to mitigate potential vulnerabilities.
  • Sources: Traefik releases
  • Tags:

15. PostgreSQL Anonymizer 3.2: Faster Pseudonymization

  • Category: Security / Patch
  • What happened: PostgreSQL Anonymizer 3.2 introduces faster pseudonymization with new functions and enhanced privacy protection features. It includes six masking strategies and a suite of advanced masking functions. The update also addresses three critical vulnerabilities that could allow privilege escalation, particularly affecting PostgreSQL 14 and earlier versions. Users are encouraged to upgrade to mitigate these security risks.
  • Do this Monday: The introduction of critical security fixes is essential for maintaining database security. The performance improvements in pseudonymization functions may also enhance data handling processes in production environments. - Users should prioritize upgrading to version 3.2 to address vulnerabilities and leverage faster data protection features.
  • Source: PostgreSQL News
  • Tags:

16. Chromium: CVE-2025-2137 Out of bounds read in V8

  • Category: Security / Patch
  • What happened: A vulnerability identified as CVE-2025-2137 has been reported in Chromium, specifically related to an out of bounds read in the V8 engine. Details on the vulnerability have been published, but no specific remediation steps or impact assessments are provided in the excerpt.
  • Do this Monday: This CVE could potentially allow attackers to exploit the V8 engine, which may affect applications relying on Chromium. Operators should monitor for updates and apply patches as they become available.
  • Source: Microsoft MSRC Security Update Guide
  • Tags:

Releases

17. Cloud Native Computing Foundation Announces Karmada Graduation

  • Category: Release
  • What happened: Karmada has officially graduated from the Cloud Native Computing Foundation (CNCF), marking its maturity as a multi-cluster orchestration tool for Kubernetes applications. The recent v1.19 release enhances scheduling capabilities for distributed AI training jobs and introduces priority-based scheduling as a default feature. Karmada is now utilized by major global enterprises and cloud platforms for managing hybrid cloud environments and ensuring resilience across multiple regions.
  • Do this Monday: The graduation of Karmada signifies its readiness for production use, which may influence organizations looking to implement multi-cluster Kubernetes solutions, especially in AI workloads. The advancements in scheduling could improve operational efficiency for critical applications across hybrid infrastructures.
  • Source: CNCF Blog
  • Tags:

Also this week

Deep dives & postmortems

18. Cloudflare: 5 service incidents (Cache Reserve Issue in Paris, +4 more)

  • Category: Deep Dive
  • What happened: Cloudflare reported multiple service disruptions on August 22nd affecting various product lines. Cache Reserve in the Paris region experienced errors that caused elevated request volumes to origin servers, requiring operators to monitor origin capacity during the incident window. Let's Encrypt certificate provisioning delays created a backlog of managed certificates, though certificates already in production remained unaffected and the backlog is now clearing. Browser Isolation sessions failed to initialize for some customers who saw white screens when accessing websites, with Cloudflare advising affected users to close all browser tabs and retry. Additionally, the TURN service experienced performance degradation that forced a significant portion of traffic to relay via TCP instead of UDP, resulting in increased latency for real-time communication users. Operators using any of these Cloudflare services should verify that normal operations have resumed and check logs for errors during the incident timeframes, particularly monitoring origin server load if using Cache Reserve in Paris and reviewing certificate renewal status for Let's Encrypt-issued certificates.
  • Takeaway: Operators in the Paris region may have experienced increased load on origin servers due to Cache Reserve errors, which could affect application performance during the incident.
  • Sources: Cloudflare Status
  • Tags:

Human Stories

The thing about cascading failures is that they're rarely about the first thing that breaks - it's what breaks second, third, and fourth that reveals how fragile our safety nets really are. When that disk filled at 2:47am, it wasn't just the database that failed; it was the monitoring, the logging, everything we'd put in place to catch exactly this kind of problem. We see the same pattern playing out everywhere this week, from Cloudflare's Cache Reserve issue in Paris generating cascading load to origins, to the AI credential leak flood that's now so massive it requires AI agents just to triage it. What strikes me most is how often our solutions create the conditions for new classes of failures - AI helps developers ship faster but generates 81% more leaked secrets, monitoring systems depend on the same disk they're supposed to watch, preview releases like Amazon Linux 2027 ship with configuration changes that can break entire provisioning pipelines. The next time we build that critical alerting system or implement that helpful developer tool, maybe the first question shouldn't be "will this work" but rather "what happens when this becomes part of the problem?"

Also worth reading

The ten minute outage that took six hours to finish (dev.to (SRE tag))

The article discusses a six-hour incident caused by a database failover that lasted nine minutes. The failover led to a backlog of 1.1 million messages due to consumers being unable to write during the failover. The author emphasizes that headroom should be viewed as a recovery rate rather than a pe

A temporary job hit its error path and ran 14,000 times in an hour. Nobody had built a ceiling above it. (dev.to (SRE tag))

A temporary sync job entered an error loop, executing 14,000 times in an hour and causing significant issues, including spamming customers and overusing a paid API. The incident was mitigated quickly due to a recently implemented kill switch. The author outlines a runbook for preventing such inciden

The canary that never saw the traffic that would have broken it (dev.to (DevOps tag))

The article discusses a failure in a canary deployment strategy where the canary did not test a critical code path due to its configuration and the nature of the traffic it received. The canary only analyzed HTTP traffic and was excluded from the Kafka consumer group, preventing it from validating a
Kubernetes News Cloud News DevOps Security News CI/CD News SRE News