On Call Brief – Week of November 1–7, 2026
Category:
Tags:
This week's top stories
1. eMudhra’s Weak Private Keys: When Internet Trust Fails at Randomness
- Category: Deep Dive
- What happened: Researchers found that eMudhra, a certificate authority, issued intermediate TLS keys with insufficient randomness, allowing them to be recreated. This raises concerns about browser trust and the effectiveness of certificate revocation processes.
- Takeaway: Evaluate the use of eMudhra certificates and consider replacing them with certificates from a more secure authority.
- Source: Security Boulevard
2. Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script
- Category: Community
- What happened: Malicious code on Polymarket's website compromised traders' accounts, resulting in the theft of approximately $2.7 million. The attackers hijacked a page-speed script, allowing them to sell traders' positions and transfer their funds. Polymarket is refunding the affected users.
- Worth reading: Monitor for unusual account activity and ensure all security measures are in place; Polymarket is refunding affected users.
- Source: The Hacker News
3. JetBrains MPS Updates Fix Critical Security Issue Across 5 Versions
- Category: Community
- What happened: JetBrains has released updates for multiple MPS versions addressing a critical security issue. Users of MPS 2025.1.5 and 2025.2.5 must disable JCEF by turning off the ide.browser.jcef.enabled flag in the MPS Registry. The updates also include improvements to the Projectional Agent Toolkit plugin in MPS 2026.1.2 and 2026.2 RC2, which enhance performance and functionality.
- Worth reading: Disable JCEF by turning off the ide.browser.jcef.enabled flag in the MPS Registry for versions 2025.1.5 and 2025.2.5.
- Source: JetBrains Blog
4. AWS Capacity Largely Sold Out Through 2027, With On Demand Headroom Reserved
- Category: Community
- What happened: AWS conducted a successful operational independence exercise for its European Sovereign Cloud by completely disconnecting it from global infrastructure and rerouting all traffic through EU-based systems, validating that the service can operate without any non-EU dependencies. Separately, AWS has disclosed that its committed cloud capacity is sold out through 2027 with partial allocations into 2028, which is causing reduced availability for On Demand EC2 instances and similar compute resources across AWS and other major cloud providers. Operators experiencing difficulties provisioning On Demand instances should evaluate Reserved Instances or Savings Plans for guaranteed capacity, consider alternative regions or availability zones where capacity may be less constrained, or engage AWS account teams to discuss capacity commitments for workloads requiring specific instance types. This capacity constraint affects immediate infrastructure scaling plans and may require adjustments to disaster recovery strategies that rely on rapid On Demand provisioning.
- Worth reading: Plan for potential capacity constraints when provisioning EC2 instances in the near future.
- Sources: InfoQ DevOps, AWS Security Blog
5. Volta Infostealer Uses AI Model to Assess the Worth of Victims
- Category: Deep Dive
- What happened: The Volta-Autodoxer malware, identified by Cisco Talos, is designed to steal various types of information from victims and utilizes AI models like Claude to assess the victim's identity, employment, and the value of their data.
- Takeaway: Informational: highlights a new malware technique using AI.
- Source: Security Boulevard
6. FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist
- Category: Community
- What happened: The FBI has attributed the theft of over $6 billion in cryptocurrency from Binance to the North Korean state-sponsored group TraderTraitor, also tracked as Jade Sleet and Slow Pisces, marking this as the largest cryptocurrency heist on record. While this incident primarily affects Binance's security posture and customer funds rather than operational infrastructure, organizations running cryptocurrency exchanges or custodial wallets should review their cold wallet separation strategies, multi-signature approval processes, and privileged access monitoring for treasury operations. Security teams should examine transaction monitoring systems for unusual withdrawal patterns and ensure that hot wallet balances are minimized to reduce exposure in similar attack scenarios. Organizations using cryptocurrency payment processing should verify that their providers maintain adequate insurance coverage and security controls given the scale of losses demonstrated in this incident.
- Worth reading: Informational: a significant cyber theft linked to a known hacking group.
- Sources: The Hacker News, Bleeping Computer
7. GitHub Actions now supports dependency lockfiles
- Category: Deep Dive
- What happened: GitHub Actions introduced support for workflow dependency lockfiles to improve CI/CD security and reproducibility by enabling users to pin specific versions of third-party actions referenced in their workflows. This feature addresses supply chain risks by preventing unexpected updates to action dependencies that could introduce vulnerabilities or breaking changes. Separately, GitLab.com experienced a performance incident that caused elevated latency across CI/CD operations, resulting in delayed job status updates and slower artifact uploads before the platform team identified and resolved the underlying issue. Operators using GitHub Actions should evaluate implementing dependency lockfiles for workflows that consume external actions, while GitLab.com users required no action as the incident was fully mitigated by the GitLab infrastructure team.
- Takeaway: Implement workflow dependency lockfiles in GitHub Actions to enhance security and reproducibility of CI/CD pipelines.
- Sources: Reddit r/devops, GitLab Status
8. LiteLLM’s Second Breach Began With a Key Nobody Revoked
- Category: Deep Dive
- What happened: The breach of LiteLLM 1.107.0 was initiated by an administrative key that was mistakenly committed to a public GitHub repository and not revoked, leading to the malicious release on PyPI. This incident highlights the importance of key management and revocation processes.
- Takeaway: Informational: highlights the need for strict key management practices.
- Source: Security Boulevard
9. SnapDeploy Migration Guide: Converting Heroku Apps to Docker with Config and Database Transfer
- Category: Community
- What happened: Migrating from Heroku involves exporting configuration variables and database dumps, converting Procfiles to Dockerfiles, and addressing common issues like port binding and static files. The guide provides practical steps and cost comparisons for moving to SnapDeploy, especially for those affected by Heroku's removal of the free tier.
- Worth reading: Export your Heroku config vars and database dump, then convert your Procfile to a Dockerfile for deployment on SnapDeploy.
- Source: dev.to (DevOps tag)
10. I built a lightweight Docker engine for Windows: no WSL, 322 MiB idle
- Category: Community
- What happened: The article discusses the creation of hyperbutler, a lightweight Docker engine for Windows that operates without WSL, addressing common issues faced with Docker Desktop such as high memory usage and slow performance. Hyperbutler is designed to be more efficient, with a smaller footprint and faster startup times, while maintaining compatibility with the standard Docker CLI and Docker Compose. It is currently in preview and open-source under the Apache-2.0 license.
- Worth reading: Informational: a new lightweight Docker engine for Windows is available.
- Source: dev.to (DevOps tag)
CVE & Security
11. Broccoli2shell: Everything You Need To Know About
- Category: Security / Patch
- What happened: CVE-2026-111497 is a critical vulnerability in the Brotli decoder that allows for remote code execution. The article provides details on how to detect and mitigate this vulnerability.
- Do this Monday: Upgrade Brotli to the latest version to mitigate CVE-2026-111497.
- Source: CloudSecList
12. RHSA-2026:94303: Critical: kernel security update
- Category: Security / Patch
- What happened: A critical security update for the kernel is available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. This update addresses vulnerabilities rated as critical by Red Hat Product Security.
- Do this Monday: Upgrade Red Hat Enterprise Linux to the latest kernel version to mitigate critical vulnerabilities.
- Source: Red Hat Security Advisories (RHSA)
13. Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw
- Category: Security / Patch
- What happened: Synology has reported ransomware attacks targeting its NAS devices by exploiting a vulnerability in the DiskStation Manager (DSM) software that was patched in December 2024. Customers are urged to update their DSM software to protect against these attacks, which aim to encrypt data and extort ransom.
- Do this Monday: Update DiskStation Manager to the latest version to mitigate ransomware risks.
- Source: The Hacker News
14. KubeVirt Virtualization Advances, PHP2Shell Critical Vulnerabilities
- Category: Security / Patch
- What happened: The article discusses the future of KubeVirt, highlighting its advancements in virtualization on Kubernetes, including support for GPUs and confidential VMs. It also addresses recent PHP vulnerabilities, particularly the PHP2Shell bugs, and the associated risks of exploits being developed rapidly. PHP has issued an advisory for CVE-2026-115560, advising users to disable session upload progress until a fix is released. Traefik suggests using a WAF as a temporary measure against PHP2Shell attacks while patching servers.
- Do this Monday: Disable session.upload_progress.enabled=0 in PHP applications until the next routine release to mitigate CVE-2026-115560 risk.
- Source: DevOps'ish
15. RHSA-2026:93537: Important: freerdp security update
- Category: Security / Patch
- What happened: An important security update for freerdp is available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. This update addresses vulnerabilities rated as having a significant security impact.
- Do this Monday: Upgrade freerdp on Red Hat Enterprise Linux 8.8 to mitigate important security vulnerabilities.
- Source: Red Hat Security Advisories (RHSA)
16. RHSA-2026:93455: Important: .NET 8.0 security update
- Category: Security / Patch
- What happened: An important security update for .NET 8.0 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support, rated as having a significant security impact.
- Do this Monday: Upgrade .NET 8.0 on Red Hat Enterprise Linux 10.0 to address security vulnerabilities.
- Source: Red Hat Security Advisories (RHSA)
17. IBM Extends Scope and Reach of DevSecOps Workflows in the AI Era
- Category: Security / Patch
- What happened: IBM is enhancing its Terraform platform and Bob AI coding assistant by introducing policy-as-code features, automated vulnerability remediation, and AI governance integrations. These updates are designed to assist DevSecOps teams in securely managing infrastructure and speeding up software delivery as AI becomes more integrated into development processes.
- Takeaway: Informational: a vendor update on DevSecOps tools.
- Source: DevOps.com
Releases
18. Cilium v1.21.0-pre.4: BGP unnumbered peering, BPF masquerading, mTLS
- Category: Release
- What happened: Cilium v1.21.0-pre.4 introduces several major changes including support for interface-based BGP unnumbered peering, default BPF masquerading, and mTLS support for the Gateway API. Minor updates include multi-pool Resource IPAM support, ingress controller port control, and enhancements for Alibaba Cloud instance metadata access.
- Do this Monday: Upgrade to Cilium v1.21.0-pre.4 to leverage new features like BGP unnumbered peering and mTLS support.
- Source: Cilium releases
Also this week
Deep dives & postmortems
19. Debugging Kubernetes: Solving MongoDB CrashLoopBackOff Caused by PVC Version Mismatches
- Category: Deep Dive
- What happened: This article discusses a real-world scenario where a MongoDB deployment in Kubernetes experienced a CrashLoopBackOff due to a version mismatch in the Persistent Volume Claim (PVC). The author details the investigation process, starting with application logs that indicated connection timeouts to MongoDB, leading to the identification of the underlying data compatibility issue. The article provides insights on how to resolve the issue safely without data loss.
- Takeaway: Investigate PVC version compatibility if encountering CrashLoopBackOff in MongoDB deployments.
- Source: dev.to (Kubernetes tag)
Status pages & maintenance
20. Fields missing across Jira Work Items for some users
- Category: Status Page
- What happened: A configuration change caused fields to be missing across Jira Work Items, impacting searching and automations. The issue has been resolved and all operations are now fully operational.
- Takeaway: Issue resolved with no further impact on operations.
- Source: Jira Status
21. Fly.io: Outbound IPv4 connectivity failures in ARN, JNB, and GRU
- Category: Status Page
- What happened: Outbound IPv4 connectivity issues in ARN, JNB, and GRU regions have been resolved and all affected components are now operational.
- Takeaway: Resolved incident with no further impact reported.
- Source: Fly.io Status
22. Cloudflare: 39 scheduled maintenance windows (Newark, Kanpur, Islamabad, +28 more)
- Category: Status Page
- What happened: Cloudflare has scheduled maintenance across 40 datacenters globally between November 2-12, 2026, with multiple facilities in India, Pakistan, South Asia, North America, Europe, and Japan affected during overlapping time windows. The maintenance will cause traffic rerouting and increased latency for all users, while PNI (Private Network Interconnect) and CNI (Cloudflare Network Interconnect) customers will experience temporary network interface unavailability requiring traffic failover preparation. Key timeframes include November 2-3 maintenance windows from 20:00-01:00 UTC across South Asian locations (DAC, DEL, AMD, HYD, KTM, MAA, CNN, KHI), November 3 North American facilities (SJC 09:00-13:00, SLC 09:00-14:00, SEA 08:00-14:00), and European datacenters (AMS, WAW, PRG, VIE, ZAG, MXP) with varied windows between 23:00-08:00 UTC. Operators using PNI/CNI connections should configure automatic failover to alternate Cloudflare datacenters or peer connections during the specified maintenance windows for their regions, while those relying on anycast routing require no action as traffic will automatically reroute through Cloudflare's global network.
- Heads up: Prepare for potential traffic failover and increased latency for users in the Chennai region during the maintenance window.
- Sources: Cloudflare Status, Cloudflare Status (2), Cloudflare Status (3) (+36 more)
Lightning links
- OpenAI built itself a new Git backend, too (The New Stack) -- OpenAI's new Git backend, Pando, boosts monorepo performance with a nearly 5x reduction in push latency.
- Governing Coding-Agent Sprawl with MLflow AI Gateway (MLflow Blog) -- The MLflow AI Gateway streamlines coding-agent management with a single governed endpoint.
- Kubernetes For AI: CIQ Packages The Moving Parts Into One Binary (Cloud Native Now) -- CIQ's Stratum Kubernetes Engine simplifies cluster deployment by consolidating components into one binary.
- Kubernetes NetworkPolicy Baseline: 3 Mistakes That Break Isolation (dev.to (Kubernetes tag)) -- Learn common pitfalls in Kubernetes NetworkPolicies to ensure proper isolation and security.
- Your telemetry doesn't go straight to the backend (dev.to (Kubernetes tag)) -- Understand how the OpenTelemetry Collector manages telemetry data effectively for applications.
- RHSA-2026:93460: Important: postgresql:16 security update (Red Hat Security Advisories (RHSA)) -- A critical security update for PostgreSQL 16 addresses significant vulnerabilities.
- RHSA-2026:93467: Important: nginx security update (Red Hat Security Advisories (RHSA)) -- An important security update for nginx is now available, addressing significant vulnerabilities.
- No cloud to lean on: building a reliable data platform on a bank's own servers (dev.to (SRE tag)) -- Explore the challenges and solutions of building a reliable data platform using Kubernetes without cloud reliance.
Human Stories
When eMudhra's certificate authority failed at something as fundamental as randomness, and Polymarket lost millions because a performance monitoring script turned malicious, we're reminded that trust compounds in layers we rarely examine until they collapse. The FBI's announcement of a $6.4 billion crypto heist by North Korean actors and the emergence of malware using Claude to profile victims shows us that while we're building increasingly sophisticated defenses, our adversaries are industrializing their operations with the same tools we use to improve ours. What strikes me most is how these incidents reveal the gap between the systems we think we've secured and the assumptions buried so deep we forget they're assumptions at all - whether that's the entropy in a key generation process, the integrity of a third-party script, or the idea that disconnecting a sovereign cloud is even possible without months of preparation. The Jira incident that got resolved quietly this week might seem minor by comparison, but it's actually the most honest story here: a configuration change broke something, people noticed, and it got fixed before it became someone's congressional testimony.
Also worth reading
Our label service ran out of local ports at four hundred and seventy requests a second (dev.to (SRE tag))
A label service experienced failures due to exhausting local ports while handling a high volume of requests during a promotional event. The service's architecture created a new TCP connection for each request, leading to rapid depletion of available local ports. The issue was resolved by implementin
