On Call Brief – Week of October 11–17, 2026

2026-10-11 — 2026-10-17 Briefing: 2026-10-11 Last updated 9 hours ago (Oct 12, 2026 3:50 am EDT) 17 min read
Share
Category:
Tags:

This week's top stories

1. RHSA-2026:80605: Critical: cjose security update

  • Category: Community
  • What happened: A critical security update for cjose is now available for Red Hat Enterprise Linux 10, rated as having a significant security impact. Detailed severity ratings are provided via the CVSS base score linked in the advisory.
  • Worth reading: This update addresses critical vulnerabilities that could affect the security posture of systems running Red Hat Enterprise Linux 10. Operators should prioritize applying this update to mitigate potential risks.
  • Source: Red Hat Security Advisories (RHSA)
  • Tags:

2. P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

  • Category: Deep Dive
  • What happened: Researchers have revealed a new variant of the DarkSword iOS exploit kit, named P7 DarkSword. This variant features a reduced on-device footprint, the ability to steal keychain and crypto-wallet data, and supports two-way communication with the attacker's infrastructure.
  • Takeaway: This exploit kit poses a significant risk to iOS users, particularly those using crypto wallets, as it can compromise sensitive financial information and facilitate remote commands.
  • Source: The Hacker News
  • Tags:

3. DevOps'ish 330: cgroup v1 gets the boot, open source closes its doors, cap your cloud bill, and more

  • Category: Deep Dive
  • What happened: Kubernetes is shifting to cgroup v2 starting with version 1.35, which will prevent kubelet from starting on cgroup v1 nodes unless overridden. This change introduces features like Memory QoS, whole-container OOM kills, and in-place Pod-level resizing. Additionally, node swap has gone GA in v1.34, allowing for improved workload scaling with benchmarks showing significant performance gains. The A2A CLI has been released for managing agents from the terminal. The article also discusses the decline of open source contributions, highlighting recent closures of public PRs and bug bounties, attributing this to the increased cost of maintenance due to AI.
  • Takeaway: The transition to cgroup v2 may require immediate action to update existing Kubernetes nodes to avoid kubelet startup issues. The introduction of node swap could enhance workload performance but requires careful configuration. The decline in open source contributions may affect the availability of community support and resources, impacting operational practices.
  • Source: DevOps'ish
  • Tags:

4. One transaction left open for three weeks stopped every write in our database

  • Category: Deep Dive
  • What happened: A long-running transaction in a Postgres database caused it to stop accepting writes for over three weeks. The issue arose when a reporting service held a connection open without rolling back after encountering an exception. This prevented the autovacuum process from freezing old rows, leading to a critical state where no new transactions could be processed. The problem was resolved by terminating the session, allowing vacuum operations to proceed and restore write capabilities. The incident prompted changes to connection handling and alerting mechanisms to prevent future occurrences.
  • Takeaway: This incident highlights the importance of managing database connections and monitoring transaction states to avoid critical failures. Implementing stricter timeout settings and alerting for long-running transactions can help prevent similar issues in production environments.
  • Source: dev.to (SRE tag)
  • Tags:

5. When /var/tmp forgot our Kafka directory

  • Category: Deep Dive
  • What happened: The article discusses an incident involving a Kafka Connect worker that failed due to a missing temporary directory after a system reboot. The worker was configured to use /var/tmp/kafka for temporary files, but this directory was not recreated after rebooting, leading to a failure when attempting to produce records with zstd compression. The author details the troubleshooting process, highlighting the importance of ensuring that necessary directories are created during startup to avoid such issues.
  • Takeaway: This incident underscores the need for proper initialization scripts to create required directories after a reboot, especially for services relying on specific temporary paths. Failure to do so can lead to service disruptions that may not be immediately apparent.
  • Source: dev.to (DevOps tag)
  • Tags:

6. Kubernetes Ingress Manifest or Gateway API: Which to Ship

  • Category: Community
  • What happened: The article discusses the decision between using a Kubernetes Ingress manifest and the newer Gateway API for exposing services with a public hostname and TLS. It highlights that while both methods are viable for simple setups, the choice becomes critical in more complex scenarios, such as when multiple teams share a cluster or specific routing features are needed. The retirement of the ingress-nginx project by March 2026 is noted as a significant factor in this decision, emphasizing the importance of future maintenance and compatibility.
  • Worth reading: Choosing between Ingress and Gateway API can affect future scalability and maintenance of services. The impending retirement of ingress-nginx may necessitate migration to Gateway API for teams relying on it, impacting their deployment strategies.
  • Source: dev.to (Kubernetes tag)
  • Tags:

7. The Data Act ends cloud switching fees on 12 January 2027

  • Category: Community
  • What happened: Starting 12 January 2027, the Data Act will prohibit cloud providers in the EU from charging switching fees, including data egress charges for transferring data to a new provider or to personal servers. Until then, providers can charge only for costs directly associated with the switch. AWS currently waives transfer charges for customers moving out, but requires requests to be made in advance. The Data Act's switching procedure is already in effect, allowing customers to begin the process now, but full benefits will only apply after the 2027 deadline.
  • Worth reading: This change could significantly reduce costs for EU customers switching cloud providers, impacting budgeting and planning for migrations. Operators should be aware of the timeline and requirements for initiating switches to avoid unexpected charges.
  • Source: dev.to (DevOps tag)
  • Tags:

8. Prometheus and OpenTelemetry interoperability in 2026: Survey results

  • Category: Community
  • What happened: A survey of OpenTelemetry and Prometheus users reveals that interoperability has improved, with ease-of-use ratings increasing from 3.1 to 3.6. The survey indicates that Prometheus exporters are still the most commonly used method for infrastructure instrumentation, while OpenTelemetry SDKs lead in application instrumentation. Many users run both systems simultaneously, and common processing steps include Prometheus relabeling rules and the OpenTelemetry Collector.
  • Worth reading: Improved interoperability between OpenTelemetry and Prometheus may reduce friction for teams using both tools, potentially leading to more efficient metric collection and processing in production environments.
  • Source: OpenTelemetry Blog
  • Tags:

9. Roblox, Robux Scams, and What Parents Need to Know

  • Category: Deep Dive
  • What happened: The article discusses various scams related to Roblox, including fake Robux offers, phishing links, and account theft. It emphasizes the importance of parental awareness and provides practical advice for parents to help protect their children from these scams.
  • Takeaway: Operators should be aware of the security risks associated with popular platforms like Roblox, as they can impact user trust and safety. Understanding these scams can help in developing better security measures and user education.
  • Source: Security Boulevard
  • Tags:

10. Our deploy script kept every value except the ones the new chart added

  • Category: Deep Dive
  • What happened: A production incident occurred when a node under memory pressure evicted checkout pods due to missing resource requests. The deploy script used --reuse-values, which retained old settings instead of applying new defaults from the updated chart. This led to 23 out of 31 services lacking memory requests in production. The team has since changed their deployment strategy to use explicit values files and reject pods without memory requests, ensuring that changes in defaults are visible in pull requests.
  • Takeaway: This incident highlights the risks of using --reuse-values in Helm deployments, which can lead to outdated configurations persisting in production. The new strategy of using explicit values files and rejecting pods without resource requests can help prevent similar issues in the future.
  • Source: dev.to (Kubernetes tag)
  • Tags:

CVE & Security

11. Actively exploited this week: 5 new CISA KEV entries (5 October to 11 October 2026)

  • Category: Security / Patch
  • What happened: CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) list, indicating they are actively being exploited. The vulnerabilities include issues in Strapi, ONLYOFFICE, Apache Struts, ISC BIND, and ProFTPD. The article emphasizes the importance of prioritizing these vulnerabilities for patching and provides a guide on how to effectively use the KEV list to mitigate risks. Additionally, it mentions recent data breaches affecting several organizations, urging teams to check if their work addresses are involved.
  • Do this Monday: The addition of these vulnerabilities to the KEV list highlights immediate risks that could affect production systems. Teams should prioritize patching these vulnerabilities to prevent exploitation. Awareness of the recent breaches is also crucial for assessing potential impacts on user data and security.
  • Source: dev.to (DevOps tag)
  • Tags:

12. GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8

  • Category: Security / Patch
  • What happened: GitLab has released versions 19.4.2, 19.3.4, and 19.2.8, which include critical security fixes and important bug fixes. Users are strongly advised to upgrade their self-managed installations immediately. The release addresses several vulnerabilities, including a critical integer overflow issue and multiple high-severity issues related to cross-site scripting and improper authorization. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action.
  • Do this Monday: Failure to upgrade to these patched versions could expose installations to critical vulnerabilities, potentially leading to security breaches. Immediate action is recommended for all self-managed GitLab installations.
  • Source: GitLab Security Releases
  • Tags:

13. Nippon Columbia malware incident exposes 8.6 million karaoke fan records

  • Category: Security / Patch
  • What happened: A malware infection at Nippon Columbia, a contractor for Daiichi Kosho, has led to the exposure of over 8.7 million records belonging to customers and employees. The incident highlights vulnerabilities in third-party contractors and the potential risks they pose to data security.
  • Do this Monday: This incident raises concerns about the security of third-party vendors and the potential for data breaches that could affect customer trust and regulatory compliance - organizations should review their vendor security practices.
  • Source: Bleeping Computer
  • Tags:

14. USN-8912-1: Perl DBI module vulnerabilities

  • Category: Security / Patch
  • What happened: Two vulnerabilities in the Perl DBI module were discovered, one allowing for potential arbitrary code execution and the other leading to possible denial of service. The vulnerabilities are identified as CVE-2026-78030 and CVE-2026-88816.
  • Do this Monday: These vulnerabilities could affect applications using the Perl DBI module, potentially leading to security breaches or service disruptions if not addressed.
  • Source: Ubuntu Security Notices (USN)
  • Tags:

15. Cybersecurity Expert Tied to ShinyHunters FBI Data Breach

  • Category: Security / Patch
  • What happened: Edward Dubrovsky, a Canadian cybersecurity expert, has been arrested in connection with the ShinyHunters data breach of FBI systems that occurred last month. This incident highlights ongoing vulnerabilities and threats to sensitive government data.
  • Do this Monday: - The arrest of a cybersecurity expert in relation to a breach of FBI systems raises concerns about the security of sensitive data and the potential for insider threats. Organizations should review their security protocols and consider the implications of such breaches on their own systems.
  • Source: Security Boulevard
  • Tags:

16. Daily OT Security News: October 11, 2026

  • Category: Security / Patch
  • What happened: The briefing highlights five verified advisories related to vulnerabilities in industrial switches, energy-sector software, communications design tools, device servers, and legacy RTU firmware. CISA has issued a warning about seven vulnerabilities affecting Red Lion N-Tron 700 Series switches, detailed in advisory ICSA-26-281-01 released on October 8.
  • Do this Monday: Operators should be aware of the vulnerabilities in the Red Lion N-Tron 700 Series switches as they may impact industrial control systems and require immediate attention to mitigate risks.
  • Source: Security Boulevard
  • Tags:

17. Claude found 29,000 possible bugs in open source. Only 516 have been fixed.

  • Category: Security / Patch
  • What happened: Anthropic's OSS Scanner has identified over 29,000 potential vulnerabilities in open source projects, but only 516 have been fixed. The scanner's findings are outpacing human verification, with a backlog of unreviewed candidates. Anthropic is providing unvalidated reports directly to maintainers to expedite the process, but concerns about inflated severity ratings and misunderstanding of threat models have been raised. The effectiveness of the scanner at scale remains uncertain.
  • Do this Monday: The high volume of identified vulnerabilities and the slow pace of fixes could indicate a growing risk for projects relying on open source components. Teams should be aware of the potential vulnerabilities in their dependencies and consider proactive measures for vulnerability management.
  • Source: The New Stack
  • Tags:

18. RHSA-2026:80503: Important: thunderbird security update

  • Category: Security / Patch
  • What happened: Red Hat has released important security updates for Thunderbird on RHEL 9.6 Extended Update Support (RHSA-2026:80503) and compat-openssl10 on RHEL 8 (RHSA-2026:80510), both rated with significant security impact. The Thunderbird update addresses vulnerabilities in the email client that could affect systems running the 9.6 EUS release track, while the compat-openssl10 update patches security issues in the OpenSSL 1.0 compatibility libraries used by legacy applications on RHEL 8. Operators should apply these updates promptly using yum or dnf package managers, prioritizing systems that run Thunderbird for email communications or applications that depend on the legacy OpenSSL 1.0 compatibility layer. CVSS scores and specific vulnerability details are available through the referenced advisories for risk assessment and change management approval processes.
  • Do this Monday: This update may require immediate attention to mitigate potential security risks associated with Thunderbird on Red Hat systems. Operators should review the CVE details to understand the vulnerabilities addressed.
  • Sources: Red Hat Security Advisories (RHSA)
  • Tags:

Releases

19. AWS Introduces Enhanced Custom Event Buses for EventBridge

  • Category: Release
  • What happened: AWS has announced enhanced custom event buses for Amazon EventBridge, which enable organizations to share a centralized bus across accounts. Key features include ordered delivery, simplified subscriber management, event replay, content-based deduplication, and a new pricing model based on publisher/subscriber usage.
  • Do this Monday: This update may affect how organizations manage event-driven architectures, potentially improving efficiency and reducing costs associated with event handling.
  • Source: InfoQ DevOps
  • Tags:

Also this week

Deep dives & postmortems

20. DNS Resolution for Managed Kubernetes

  • Category: Deep Dive
  • What happened: DigitalOcean's Engineering team has resolved external DNS resolution failures that affected Managed Kubernetes clusters across multiple regions. The issue caused intermittent failures in resolving external domain names, impacting applications running on these clusters. The team monitored the situation after implementing a fix and confirmed that the problem is now resolved.
  • Takeaway: This incident may have caused disruptions for applications relying on external DNS resolution in Managed Kubernetes. Operators should verify that their applications are functioning correctly post-resolution.
  • Source: DigitalOcean Status
  • Tags:

21. Sprite hosting outage

  • Category: Deep Dive
  • What happened: A hosting outage affected some or all sprites on the *.sprites.app subdomain due to a certificate error. The incident lasted from 2026-10-11 23:30 UTC to 2026-10-12 00:45 UTC and has since been resolved.
  • Takeaway: This outage may have impacted users relying on the sprites.app subdomain for hosted services, potentially causing disruptions in service availability during the incident.
  • Source: Fly.io Status
  • Tags:

22. Bitbucket Cloud - Database Maintenance

  • Category: Deep Dive
  • What happened: Bitbucket will conduct scheduled database maintenance on October 17, 2026, from 16:00 to 16:30 UTC. This maintenance will involve a short downtime affecting all Bitbucket Cloud services, including the website, Git operations, API requests, and Bitbucket Pipelines, with potential performance degradation during the maintenance window.
  • Takeaway: Operators should prepare for a brief downtime and possible performance issues across all Bitbucket Cloud services during the scheduled maintenance.
  • Source: Bitbucket Status
  • Tags:

Community reads

23. Cloudflare: 16 scheduled maintenance windows (Singapore, Osaka, Singapore, +13 more)

  • Category: Community
  • What happened: Cloudflare has scheduled multiple maintenance windows across 8 datacenters between October 12-16, 2026, affecting LHR (London), DEN (Denver), SYD (Sydney), SIN (Singapore), HKG (Hong Kong), BOM (Mumbai), and KIX (Osaka). Each datacenter will undergo maintenance for 4-8 hour windows during which traffic will be automatically rerouted, potentially causing increased latency for end-users in those regions. Operators should monitor application performance during the specified maintenance windows for their geographic regions and prepare for possible disruptions if using Private Network Interconnect (PNI) or Cloudflare Network Interconnect (CNI) connections. No action is required for standard Cloudflare customers as traffic rerouting will occur automatically, but customers with direct network interconnects should verify redundancy and failover configurations before their datacenter's maintenance window.
  • Worth reading: Operators should anticipate increased latency and possible traffic failover during the maintenance window, which could affect user experience and connectivity for services relying on the KIX datacenter.
  • Sources: Cloudflare Status
  • Tags:

Human Stories

Looking at this week's incidents, I keep coming back to how the smallest oversights cascade into the biggest fires. A single forgotten transaction in Postgres locks your entire database for three weeks, a temporary directory assumption in /var/tmp takes down your Kafka workers, and a DNS resolution bug quietly breaks clusters across multiple regions. The DarkSword exploit and the cjose vulnerability remind us that while we're busy wrestling with these operational surprises, someone else is methodically studying the systems we've built, looking for their own small oversights to exploit. What strikes me most is that none of these failures came from exotic technology or bleeding-edge features - they came from the unglamorous fundamentals we think we understand: transaction management, filesystem conventions, DNS resolution. The work of keeping systems running isn't about chasing the newest Gateway API or cgroup version; it's about obsessively questioning the assumptions we made six months ago that still seemed obvious yesterday.

Also worth reading

I gave my AI access to the shell. Built this after it almost "helped" me too much. (Reddit r/devops)

An engineer shared their experience of giving an AI assistant access to their shell, which led to potential risks of destructive commands being executed. In response, they developed 'never-rm-rf', a set of Markdown rules that requires human approval for command execution and includes a banned list o
Kubernetes News Cloud News DevOps Security News CI/CD News SRE News