On Call Brief – Week of September 13–19, 2026

2026-09-13 — 2026-09-19 Briefing: 2026-09-13 Last updated 15 hours ago (Sep 19, 2026 3:51 am EDT) 18 min read
Share
Category:
Tags:

This week's top stories

1. IETF HTTP QUERY Method Creates Security Gaps in WAF and API Controls

  • Category: Deep Dive
  • What happened: The IETF has introduced a new HTTP method called 'QUERY', which functions as a hybrid between GET and POST. This method allows for a request body and is designed to be safe and idempotent. However, existing web infrastructure controls such as WAF rules and API gateways may not recognize this new method, leading to potential security vulnerabilities. For instance, if WAF signatures are only configured for POST bodies, they may inadvertently allow malicious payloads through QUERY requests. The inconsistent handling of QUERY across different platforms and tools further complicates its adoption and security implications.
  • Takeaway: The introduction of the QUERY method could expose existing web applications to security risks if controls are not updated to recognize it. This could lead to bypasses in WAF protections and caching issues, necessitating a review of current security configurations and practices.
  • Source: SANS ISC
  • Tags:

2. Degradation with Gemini 3.8 Flash

  • Category: Community
  • What happened: GitHub experienced degraded availability affecting Copilot AI Model Providers, specifically related to Gemini 3.8 Flash, with investigation ongoing according to GitHub Status. Separately, Bitbucket Cloud has scheduled database maintenance for October 3rd, 2026, from 16:00 to 16:30 UTC that will cause a 30-minute outage impacting all Bitbucket Cloud services. Operators should monitor GitHub Status for resolution updates on the Copilot degradation and plan development workflows to avoid the Bitbucket maintenance window. Teams relying on GitHub Copilot should prepare fallback workflows if AI-assisted coding becomes unavailable, while Bitbucket users should complete time-sensitive CI/CD operations and repository access before 16:00 UTC on the scheduled date.
  • Worth reading: This degradation may affect users relying on Copilot AI Model Providers for their workflows - it is important to monitor the service status and prepare for potential disruptions.
  • Sources: GitHub Status, Bitbucket Status
  • Tags:

3. Kubernetes 1.37 Released with Workload-Aware Scheduling and KubeletInUserNamespace Beta

  • Category: Community
  • What happened: Kubernetes v1.37 has been released with several significant features for production environments, including workload-aware scheduling enhancements that improve pod placement decisions, and KubeletInUserNamespace (rootless mode) graduating to beta status for improved security isolation by running the kubelet without requiring root privileges. The release also introduces new node lifecycle conditions that provide better visibility into node states. SRE teams should review the workload-aware scheduling capabilities to optimize resource utilization across clusters and evaluate the beta rootless mode feature for security-sensitive workloads, particularly in multi-tenant environments. Operators planning to upgrade should test the new node lifecycle conditions in staging environments to ensure monitoring and alerting systems properly handle the enhanced node state reporting before rolling out to production clusters.
  • Worth reading: These updates may require adjustments in existing Kubernetes configurations, particularly with the breaking changes in the Workload and PodGroup APIs. The promotion of KubeletInUserNamespace to beta could enhance security practices in clusters, while the new node lifecycle conditions could improve operational visibility but currently do not enforce any behavior changes.
  • Sources: DevOps'ish
  • Tags:

4. RHSA-2026:67830: Important: tesseract security update

  • Category: Deep Dive
  • What happened: An important security update for tesseract is now available for Red Hat Enterprise Linux 10. The update has been rated as having a significant security impact, with detailed severity ratings available through the associated CVE links.
  • Takeaway: This update may require immediate attention to mitigate potential security risks associated with tesseract on Red Hat systems - ensure systems are updated to maintain security posture.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

5. Milvus Client 3.0.0 Released with Breaking Changes and New Features

  • Category: Breaking Change
  • What happened: Milvus has released version 3.0.0 of its client, which introduces significant changes including a new Go module path, decoupling from server-side dependencies, and various new features such as collection snapshot management, read-only external collections, and enhanced search capabilities. Notably, this version is not guaranteed to be compatible with Milvus 2.6 servers, and there are breaking changes that require migration of imports and proto types. Client telemetry is enabled by default, and the SDK now adheres to GA SemVer 3.0.0.
  • Do this Monday: The release of Milvus client v3.0.0 may affect production systems using the previous version due to breaking changes and the need for migration. Operators should review the new features and changes to ensure compatibility and leverage the new capabilities for improved functionality.
  • Source: Milvus releases
  • Tags:

CVE & Security

6. CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

  • Category: Security / Patch
  • What happened: CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. One notable vulnerability is CVE-2025-39682, which has a CVSS score of 9.8 and involves an improper check in the TLS receive path.
  • Do this Monday: This could lead to significant security risks for systems running affected Linux kernel versions, necessitating immediate attention and patching to mitigate potential exploitation.
  • Source: The Hacker News
  • Tags:

7. Cisco warns of max severity ISE zero-day exploited in attacks

  • Category: Security / Patch
  • What happened: Cisco has issued security updates for a critical vulnerability in its Identity Services Engine that is currently being exploited by attackers. The updates aim to mitigate the risks associated with this zero-day vulnerability.
  • Do this Monday: This vulnerability poses a significant risk to systems using Cisco's Identity Services Engine, and immediate action is required to apply the security updates to prevent potential exploitation.
  • Source: Bleeping Computer
  • Tags:

8. Cisco patches Secure Email Gateway zero-day exploited in attacks

  • Category: Security / Patch
  • What happened: Cisco has issued a warning regarding a critical zero-day vulnerability in its Secure Email Gateway, which is currently being exploited by threat actors to execute commands with root privileges. Customers are advised to apply the necessary patches to mitigate this security risk.
  • Do this Monday: This zero-day vulnerability poses a significant risk as it allows attackers to gain root access, potentially leading to unauthorized control over email communications. Immediate patching is essential to protect sensitive data and maintain system integrity.
  • Source: Bleeping Computer
  • Tags:

9. Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

  • Category: Security / Patch
  • What happened: A critical vulnerability in AsyncOS Software for Cisco Secure Email Gateway, identified as CVE-2026-76461, is currently being exploited in the wild. The flaw involves insufficient validation in the email parsing logic, potentially allowing unauthenticated remote attackers to execute root commands.
  • Do this Monday: This vulnerability poses a significant risk as it enables remote command execution, which could lead to unauthorized access and control over affected systems - immediate patching is recommended to mitigate potential exploitation.
  • Source: The Hacker News
  • Tags:

10. CISA: Hackers now exploit max severity GitLab flaw in attacks

  • Category: Security / Patch
  • What happened: CISA has issued a warning that hackers are actively exploiting a critical vulnerability in GitLab. This vulnerability has been classified as maximum severity, indicating a significant risk to users who have not yet applied the necessary patches.
  • Do this Monday: Organizations using GitLab should prioritize applying the latest security updates to mitigate the risk of exploitation. Failure to do so could lead to unauthorized access or data breaches.
  • Source: Bleeping Computer
  • Tags:

11. Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens

  • Category: Security / Patch
  • What happened: A critical vulnerability in WSO2 API Manager, identified as CVE-2026-5430, allows for improper verification of cryptographic signatures, potentially leading to account takeover. This flaw is currently being actively exploited, raising significant security concerns for users of the API Manager.
  • Do this Monday: Operators using WSO2 API Manager should prioritize applying patches to mitigate the risk of account takeover due to this critical vulnerability. Immediate action is recommended to prevent exploitation.
  • Source: The Hacker News
  • Tags:

12. USN-8750-1: FFmpeg vulnerabilities

  • Category: Security / Patch
  • What happened: Multiple vulnerabilities in FFmpeg have been identified, primarily related to improper handling of memory operations. These vulnerabilities could lead to denial of service or sensitive information leakage if a user or automated system opens a specially crafted file. Several CVEs have been assigned, including CVE-2026-12706, CVE-2026-30999, CVE-2026-58049, CVE-2026-70629, CVE-2026-70630, CVE-2026-70631, and CVE-2026-8461.
  • Do this Monday: These vulnerabilities could impact systems using FFmpeg, leading to potential denial of service or data leaks if not addressed. Operators should prioritize patching affected systems to mitigate risks associated with these CVEs.
  • Source: Ubuntu Security Notices (USN)
  • Tags:

13. USN-8749-1: CivetWeb vulnerabilities

  • Category: Security / Patch
  • What happened: CivetWeb has vulnerabilities that could allow remote attackers to cause denial of service or execute arbitrary code due to improper URI and HTTP request parsing. These issues affect Ubuntu 22.04 LTS and Ubuntu 24.04 LTS, with specific CVEs identified as CVE-2025-55763 and CVE-2025-9648.
  • Do this Monday: Operators using CivetWeb on affected Ubuntu versions should apply security updates to mitigate potential denial of service and code execution risks.
  • Source: Ubuntu Security Notices (USN)
  • Tags:

14. ALAS2023LIVEPATCH-2026-379 (important): kernel-livepatch-6.12.94-123.174

  • Category: Security / Patch
  • What happened: The advisory details important kernel live patches addressing multiple CVEs, including CVE-2026-68121, CVE-2026-74469, CVE-2026-80844, and CVE-2026-81000. These patches are crucial for maintaining system security and stability.
  • Do this Monday: Applying these live patches is essential to mitigate vulnerabilities that could affect system security and performance - ensure timely updates to prevent potential exploits.
  • Source: Amazon Linux 2023 Security Advisories (ALAS2023)
  • Tags:

15. ALAS2023LIVEPATCH-2026-378 (important): kernel-livepatch-6.1.176-223.369

  • Category: Security / Patch
  • What happened: This advisory addresses multiple CVEs related to the kernel live patch for Amazon Linux 2023, specifically CVE-2026-68121, CVE-2026-74469, CVE-2026-80844, and CVE-2026-81000. It is important for users to apply this live patch to mitigate potential vulnerabilities in the kernel.
  • Do this Monday: Applying this live patch is critical to protect against vulnerabilities that could affect system stability and security. Failure to update may expose systems to risks associated with these CVEs.
  • Source: Amazon Linux 2023 Security Advisories (ALAS2023)
  • Tags:

16. ALAS2023LIVEPATCH-2026-377 (important): kernel-livepatch-6.12.92-122.168

  • Category: Security / Patch
  • What happened: Amazon has released a security advisory for kernel live patching addressing multiple CVEs, including CVE-2026-68121, CVE-2026-74469, CVE-2026-80844, and CVE-2026-81000. This patch is important for maintaining system security and stability.
  • Do this Monday: Applying this live patch is crucial to mitigate vulnerabilities that could affect system integrity and security - ensure timely updates to prevent potential exploits.
  • Source: Amazon Linux 2023 Security Advisories (ALAS2023)
  • Tags:

17. Chromium CVE-2026-87499: Incorrect authorization in Network

  • Category: Security / Patch
  • What happened: CVE-2026-87499 addresses an incorrect authorization vulnerability in Chromium, which affects Microsoft Edge as it is based on Chromium. Users are advised to check for updates to mitigate this security risk.
  • Do this Monday: This vulnerability could potentially allow unauthorized access to sensitive information in applications using Chromium, including Microsoft Edge. Immediate updates are recommended to secure affected systems.
  • Source: Microsoft MSRC Security Update Guide
  • Tags:

18. Chromium CVE-2026-87498: Missing authorization in WebUI

  • Category: Security / Patch
  • What happened: CVE-2026-87498 is a vulnerability in Chromium that involves missing authorization in the WebUI. Microsoft Edge, which is based on Chromium, is affected as it ingests Chromium code. Users are advised to refer to Google Chrome Releases for further details on the fix.
  • Do this Monday: This vulnerability could lead to unauthorized access in applications using the affected WebUI, necessitating immediate updates to Chromium-based browsers like Microsoft Edge to mitigate risks.
  • Source: Microsoft MSRC Security Update Guide
  • Tags:

19. Chromium CVE-2026-87497: Uninitialized resource in Codecs

  • Category: Security / Patch
  • What happened: CVE-2026-87497 is a vulnerability related to uninitialized resources in Codecs within Chromium. Microsoft Edge, which is based on Chromium, is affected as it ingests Chromium code. Users are advised to refer to the Google Chrome Releases for further details on the fix.
  • Do this Monday: This vulnerability could potentially lead to security risks in Microsoft Edge. Operators should ensure that their Edge installations are updated to mitigate any associated risks.
  • Source: Microsoft MSRC Security Update Guide
  • Tags:

20. More JFrog Artifactory Bugs Are Under Attack, and All Three Have Patches

  • Category: Security / Patch
  • What happened: JFrog Artifactory is experiencing active exploitation of three vulnerabilities, all of which now have patches available from the vendor. According to DevOps.com, delayed patching of these issues poses significant risk by potentially transforming artifact repositories into software supply chain attack vectors. Operators running JFrog Artifactory should immediately identify their deployed versions, review the available patches from JFrog, and prioritize patching given the confirmed active exploitation. The specific CVE numbers and affected version ranges were not disclosed in the available reporting, so administrators should consult JFrog's security advisories directly for detailed remediation guidance.
  • Do this Monday: Organizations using JFrog Artifactory should prioritize applying the patches to prevent potential exploitation and secure their software supply chain.
  • Sources: DevOps.com
  • Tags:

21. GPT-6 Astra Is the First Model OpenAI Classifies as Critical for Cybersecurity

  • Category: Security / Patch
  • What happened: OpenAI has designated GPT-6 Astra as Critical for cybersecurity, marking a first under its Preparedness Framework. Testing revealed the model's ability to identify previously unknown vulnerabilities in a browser and an OS kernel, along with the capability to create working exploits. However, there is a noted decline in chain-of-thought monitorability.
  • Do this Monday: This classification indicates that GPT-6 Astra could significantly impact cybersecurity practices, as it can uncover vulnerabilities that may affect production systems. The decline in monitorability raises concerns about the reliability of its outputs in security contexts.
  • Source: InfoQ DevOps
  • Tags:

22. A Poisoned npm Package Infected Our Production Server, Here's How We Found and Removed It

  • Category: Security / Patch
  • What happened: An incident involving a poisoned npm package led to a security breach on a CI server. The attacker used a remote-code stager that executed malicious code through a specific app's deployment. The investigation ruled out various potential entry points and confirmed the malware was delivered via a compromised npm package. The resolution involved containing the threat, cleaning the npm cache, and rotating credentials. Key lessons included the importance of isolating self-hosted runners and ensuring thorough cache cleaning during dependency updates.
  • Do this Monday: This incident highlights the risks associated with shared CI environments and the need for strict dependency management. Operators should ensure that self-hosted runners are isolated and implement robust security measures to prevent similar supply-chain attacks. Regular audits and immediate credential rotation are critical in response to potential breaches.
  • Source: dev.to (DevOps tag)
  • Tags:

Also this week

Community reads

23. Cloudflare: 60 scheduled maintenance windows (Phoenix, Los Angeles, +58 more)

  • Category: Community
  • What happened: Cloudflare has scheduled maintenance across multiple datacenters throughout September and October 2026, affecting regions in North America, South America, Europe, Asia-Pacific, and Africa. North American maintenance windows include multiple dates for IAD (Ashburn) from September 14-22 with 4-hour windows starting at 06:00 UTC, EWR (Newark) on September 14-15 with varying durations up to 7 hours, ATL (Atlanta) on September 14 for a 15-hour window (07:00-22:00 UTC), PHX (Phoenix) across September 14-17 with 8-hour windows starting at 06:30 UTC, LAX (Los Angeles) on September 15-18, YYZ (Toronto) on September 16, ORD (Chicago) on September 15, PDX (Portland) on September 15, and CLE (Cleveland) on September 17-18. Asia-Pacific and other regions include extensive maintenance windows for BOM (Mumbai) across October 14-22, DEL (New Delhi) on September 21 and October 27-29, MAA (Chennai) on September 15 and October 28-29, SIN (Singapore) on October 9-16, KIX (Osaka) on October 14-16, SYD (Sydney) on October 9 and 12, ICN (Seoul) on October 9, HKG (Hong Kong) on September 21, plus GRU (São Paulo) on September 15-18, CPT (Cape Town) on September 18, and several other locations. During all maintenance windows traffic will be re-routed which may increase latency for end-users in affected regions, and customers using PNI (Private Network Interconnect) or CNI (Cloudflare Network Interconnect) should prepare for possible interruptions according to Cloudflare Status notifications.
  • Worth reading: Operators should anticipate increased latency and possible traffic rerouting during the maintenance window, which could affect user experience and connectivity for services relying on the Ashburn datacenter.
  • Sources: Cloudflare Status
  • Tags:

Human Stories

Looking at the QUERY method introduction alongside Kubernetes 1.37's workload-aware scheduling and Milvus 3.0's breaking changes, I'm reminded that evolution in our stack is never just about adding capabilities - it's about inherited complexity we didn't ask for. The IETF didn't set out to create WAF bypass opportunities, but here we are needing to audit every security control because someone decided GET needed a body. Meanwhile, Cloudflare's 60 scheduled maintenance windows spread across two months tells a different story about the same problem: the infrastructure we depend on is so vast and interconnected that even routine updates become orchestration nightmares. What strikes me is how little control we actually have - we can't stop the QUERY method from existing, we can't pause Kubernetes releases, and we definitely can't tell Cloudflare to consolidate their maintenance windows. The job has always been about adapting to change we don't control, but weeks like this make it clear that our real skill isn't implementing new features, it's managing the cascading consequences of everyone else's progress.

Also worth reading

MinIO on EC2 Auto Scaling Group fails after September patching — bootstrap download returns HTTP 413 (Reddit r/devops)

A user reports that their MinIO application running on an EC2 Auto Scaling Group fails to recover after September patching. The usual recovery process, which involves terminating the instance and launching a new one, results in an HTTP 505 error. The logs indicate that the MinIO binary download fail

A "better prompt" stopped catching AI-generated security issues after one session. (Reddit r/devops)

An engineer shares their experience with an AI coding assistant that failed to consistently catch security issues in code, such as hardcoded secrets and SQL injection vulnerabilities. After a prompt-based approach proved ineffective, they implemented a five-phase pre-commit gate to enhance security

The handoff is where outages are born (and the 5-line fix) (dev.to (SRE tag))

The article discusses how many outages originate from inadequate shift handoffs that fail to convey critical state information. It emphasizes the importance of context over checklists and proposes a simple five-line handoff format to improve communication between shifts. This format includes key det
Kubernetes News Cloud News DevOps Security News CI/CD News SRE News