On Call Brief – Week of November 8–14, 2026

2026-11-08 — 2026-11-14 Briefing: 2026-11-08 Last updated 18 hours ago (Nov 10, 2026 3:51 am EST) 16 min read
Share
Category:
Tags:

This week's top stories

1. Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026

  • Category: Security / Patch
  • What happened: Google released a security update for Chrome addressing nine vulnerabilities, including a high-severity use-after-free bug (CVE-2026-125350) that is actively exploited. This vulnerability affects the XML component of Chrome.
  • Do this Monday: Upgrade Chrome to the latest version to mitigate the active exploitation risk.
  • Source: The Hacker News
  • Tags:

2. N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits

  • Category: Security / Patch
  • What happened: N-able has taken its N-central Hosted Environments offline due to the disclosure of 33 vulnerabilities, collectively known as Able2Shell, and is advising on-premises customers to shut down their servers until further notice.
  • Do this Monday: Shut down all on-premises N-central servers until further notice to mitigate risk.
  • Source: The Hacker News
  • Tags:

3. Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

  • Category: Security / Patch
  • What happened: Between October 14 and October 26, 2026, an attacker obtained AWS credentials belonging to Qubole and used them to access customer AWS accounts through cross-account IAM roles that customers had configured to trust Qubole's AWS account. The threat actor leveraged this trusted relationship to breach multiple customer environments and exfiltrate stored secrets and data, though Qubole has not disclosed how the credentials were initially compromised. Operators using Qubole integrations should review CloudTrail logs for unexpected AssumeRole activity originating from Qubole's AWS account during the attack window and evaluate whether their cross-account trust relationships with third-party services include appropriate external ID requirements and session policies to prevent similar abuse. Organizations should audit all existing cross-account IAM roles to ensure they implement least-privilege access and consider adding condition keys that restrict access by source IP or require multi-factor authentication where feasible.
  • Do this Monday: Review AWS access logs for any unauthorized access and rotate credentials for Qubole accounts immediately.
  • Sources: The Hacker News, Wiz Blog
  • Tags:

4. Apiiro found 1,122 public .claude/settings.local.json files holding secrets. gitleaks and TruffleHog missed 215 of them

  • Category: Deep Dive
  • What happened: Apiiro's scan of public .claude/settings.local.json files on GitHub revealed that 1,122 files contained secrets, including database passwords and AWS keys. Gitleaks and TruffleHog missed 215 of these secrets, primarily due to common patterns that evade detection. To mitigate exposure, it is recommended to rotate the exposed secrets, remove the file from the repository's cache, and add it to .gitignore.
  • Takeaway: Rotate any exposed secrets and run 'git rm --cached .claude/settings.local.json' followed by adding it to .gitignore.
  • Source: Reddit r/devops
  • Tags:

5. AWS Nitro Sandboxes: Hardware-enforced workload isolation on Amazon EKS

  • Category: Community
  • What happened: AWS has launched Nitro Sandboxes for Amazon EKS, providing hardware-enforced isolation for Kubernetes pods. This feature allows each pod to run in its own lightweight virtual machine, ensuring strong security isolation without the need for dedicated EC2 instances. This is particularly beneficial for multi-tenant SaaS applications, regulated workloads, and environments where untrusted code execution is a concern. Enabling Nitro Sandboxes requires a simple change to the pod specification without altering container images or deployment processes.
  • Worth reading: Enable Nitro Sandboxes by adding the appropriate configuration to your pod spec in EKS Auto Mode.
  • Source: AWS Containers Blog
  • Tags:

6. Your AI API Key Leaked: What to Do Right Now and How to Limit the Damage Next Time

  • Category: Deep Dive
  • What happened: A developer experienced unauthorized charges due to an exposed AI API key linked to a third-party provider, highlighting the risks of storing keys in hosted services. The incident at OpenCode affected 1.4% of users, with attackers exploiting a legacy system. The article outlines steps to take if a key leaks, including revoking the key, checking usage, contacting the provider, rotating related secrets, and identifying the cause of the leak.
  • Takeaway: Revoke any exposed API keys immediately and rotate related secrets to prevent unauthorized usage.
  • Source: dev.to (DevOps tag)
  • Tags:

7. GitGuardian Catalogs 45 LLM-Powered Penetration Testing Frameworks and Their Risks

  • Category: Deep Dive
  • What happened: The article catalogs 45 open-source agentic attack frameworks that automate penetration testing using language models. It highlights that while four frameworks include a secret scanner, none provide a complete pipeline. Many operator consoles are exposed on the internet, with significant risks associated with widely forked projects. The post serves as a resource for identifying these tools and understanding their capabilities in hunting for secrets on public GitHub.
  • Takeaway: Review your exposure to these frameworks and ensure that sensitive data is not accessible via public repositories.
  • Source: GitGuardian Blog
  • Tags:

8. Simplify cross-partition access with AWS IAM outbound identity federation

  • Category: Community
  • What happened: AWS IAM now supports outbound identity federation for cross-partition access, allowing workloads in one AWS partition to assume roles in another using short-lived JWTs. This feature simplifies cross-partition resource access while maintaining security through temporary credentials and compliance considerations.
  • Worth reading: Implement cross-partition access using sts:GetWebIdentityToken and sts:AssumeRoleWithWebIdentity for workloads needing to interact with resources in different AWS partitions.
  • Source: AWS Security Blog
  • Tags:

9. AWS Capacity Largely Sold out through 2027, with On-Demand Headroom Reserved

  • Category: Community
  • What happened: AWS's committed capacity is largely sold out through 2027, with some headroom reserved for On-Demand services, EC2, and Bedrock. Users are experiencing EC2 capacity errors, particularly in CI and production Kubernetes clusters, raising concerns about the implications of reserving capacity.
  • Worth reading: Plan for potential EC2 capacity issues in production environments and consider reserving capacity if necessary.
  • Source: InfoQ via DevOps'ish
  • Tags:

10. Help defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validation

  • Category: Community
  • What happened: Amazon Bedrock AgentCore introduces multi-layer write validation to defend against memory poisoning, a risk where malicious content can persist in an agent's memory across sessions. The solution enhances existing security controls by adding an embedding-based semantic-drift signal to flag content that diverges from session context. This approach aligns with best practices for memory isolation and input validation without requiring changes to agent code.
  • Worth reading: Implement the new multi-layer write validation in Amazon Bedrock AgentCore to enhance memory security against poisoning attacks.
  • Source: AWS Security Blog
  • Tags:

CVE & Security

11. CVE-2026-111497 Portfolio Status

12. Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

13. Terminal2Shell: Critical flaw grants instant shell access on every major OS

14. Php2shell: what zero-day response looks like for IONIX customers

15. CISA Adds Four Known Exploited Vulnerabilities to Catalog

  • Category: Security / Patch
  • What happened: CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, which are actively being exploited. The vulnerabilities include improper authentication in GPUStack, code injection in SignalWire FreeSwitch, unexpected status code in OpenBSD OpenSSH, and incorrect authorization in IBM Aspera Faspex. CISA encourages organizations to prioritize remediation of these vulnerabilities, especially those that could grant total control of affected assets post-exploitation.
  • Do this Monday: Review and prioritize remediation for CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, and CVE-2026-123218 based on your exposure and risk assessment.
  • Source: CISA Cybersecurity Advisories
  • Tags:

16. LangChain Core 1.7.7 Released with Security Fixes and Nesting Depth Cap

  • Category: Security / Patch
  • What happened: The release of langchain-core version 1.7.7 includes a fix to cap nesting depth in the load() function and updates dependencies to address security lock resolutions for newer Python versions.
  • Do this Monday: Upgrade to langchain-core version 1.7.7 to benefit from the nesting depth fix and security updates.
  • Source: LangChain releases
  • Tags:

Releases

17. Lima v2.3: Native on Windows, VMnet on Linux, and menu TUI

  • Category: Release
  • What happened: Lima v2.3 introduces native support for Windows without extra dependencies, utilizing the Host Compute System (HCS) for VM management. Linux users gain real IP address networking through socket_vmnet, and a new terminal UI enhances VM management across all platforms. The update also includes installation instructions for Windows and Homebrew users.
  • Do this Monday: Install Lima on Windows using PowerShell with 'winget install Lima.Lima' to utilize the new HCS driver for VM management.
  • Source: CNCF Blog
  • Tags:

Also this week

Deep dives & postmortems

18. Claude Code settings.local.json Secrets: 17 months of exposure on GitHub, & Docker Hub

  • Category: Deep Dive
  • What happened: GitGuardian discovered 31,088 secrets in Claude Code's settings.local.json file on public GitHub, with 5,343 of them being valid. A significant number of these secrets also made their way into public Docker Hub images, including a valid Cloudflare API token found in 559 tags. The monthly leaks peaked in April 2026 but have since dropped significantly, although the reasons for this decline are unclear.
  • Takeaway: Informational: significant exposure of secrets in public repositories.
  • Source: GitGuardian Blog
  • Tags:

19. Three Men Indicted for Using AI to Impersonate CEOs and Steal $129 Million

  • Category: Deep Dive
  • What happened: Three individuals have been indicted for using AI deepfake technology to impersonate CEOs and lawyers, resulting in the theft of $129 million from various companies by convincing employees to transfer funds to fraudulent accounts.
  • Takeaway: Informational: highlights the risks of AI impersonation scams.
  • Source: Security Boulevard
  • Tags:

Community reads

20. Docker Engine 29 upgrade gotchas for production hosts

  • Category: Community
  • What happened: Upgrading to Docker Engine 29 can lead to issues such as reverse proxies failing to discover containers due to an increased minimum API version. It is recommended to pin the Docker package, inventory API clients, and upgrade one canary host first. The upgrade also changes the default image store to containerd and introduces an experimental nftables firewall backend. Live restore does not cover major upgrades, so plan for container restarts.
  • Worth reading: Pin the Docker package and upgrade one canary host before rolling out Docker Engine 29 to avoid API compatibility issues.
  • Source: dev.to (DevOps tag)
  • Tags:

Status pages & maintenance

21. GitHub: 5 service incidents

  • Category: Status Page
  • What happened: GitHub experienced multiple service disruptions between November 8 and November 10, 2026, affecting various platform components. The GPT-5.3 Codex and GPT-5.6 models in Copilot products suffered degraded availability on November 10 due to upstream model provider issues, while Webhooks and Actions experienced performance problems on November 9, 2026 (as dated in the original report). API requests for unauthenticated users saw increased timeouts and 504 errors on November 8 and November 9, triggered by a surge in anonymous user traffic that impacted CI jobs and release downloads. All incidents have been resolved with mitigation measures applied and monitoring in place, though operators should be aware that root cause analyses are pending and future preventive measures have not yet been disclosed.
  • Heads up: Switch to another model or select Auto in Copilot until the issue is fully resolved.
  • Sources: GitHub Status, GitHub Status (2), GitHub Status (3) (+2 more)
  • Tags:

22. Anthropic: Degraded performance for Claude Fable 5.1

  • Category: Status Page
  • What happened: A performance issue affecting Claude Fable 5.1 was resolved after causing elevated errors on requests for approximately 14 minutes on November 8. The incident began at 08:18 UTC and was monitored until recovery was confirmed shortly after.
  • Takeaway: Resolved incident with no ongoing impact reported.
  • Source: Anthropic Status
  • Tags:

23. Datadog: Delayed Traces in APM

  • Category: Status Page
  • What happened: Datadog identified and fixed an issue causing increased latency in processing traces in APM Trace Search, leading to missing or delayed traces for some users. While the issue is resolved, users may still experience delays as the backlog is processed.
  • Heads up: Monitor APM Trace Search for any delayed traces until the backlog is fully processed.
  • Source: Datadog Status
  • Tags:

24. Cloudflare: 3 service incidents (Account Analytics Filter Issue, +2 more)

  • Category: Status Page
  • What happened: Cloudflare experienced three operational issues between November 9-10, 2026 affecting different service components. Network performance degradation impacted users in Eastern North America on November 9 with mitigation work in progress, while Workers API operations (create, edit, delete) faced delays during the same timeframe though already deployed Workers continued functioning normally. A separate Analytics dashboard filter issue on November 10 has been resolved after implementing and monitoring a fix. No operator action is required as these were platform-level incidents managed by Cloudflare, but teams relying on Workers deployments during the November 9 window should verify that any configuration changes were properly applied.
  • Takeaway: Existing Workers are unaffected by the current issue.
  • Sources: Cloudflare Status, Cloudflare Status (2), Cloudflare Status (3)
  • Tags:

Human Stories

Looking at the cascade of secrets exposure through Claude's settings files - over 31,000 discovered by GitGuardian, 1,122 more by Apiiro, many missed by our standard tooling - I'm reminded that our defensive layers are only as strong as their ability to adapt to new attack surfaces. We've gotten pretty good at catching secrets in traditional config files and environment variables, but the moment a new tool introduces a new configuration pattern, we're back to square one. The $129 million AI impersonation fraud and those repeated GitHub service incidents tell a parallel story: the systems we're building are becoming more complex and powerful, which means the blast radius of our mistakes keeps growing. What strikes me most is that this isn't about any single team failing at security or reliability - it's about the speed at which our ecosystem evolves outpacing our ability to extend protection to every new corner. The developer who found their AI API key leaked and faced unauthorized charges learned this the hard way, and honestly, any of us could be next if we're not constantly questioning what new configuration file or integration point we haven't yet taught our scanners to watch.

Also worth reading

Topstep’s migration journey: Self-managed Redis OSS to Amazon ElastiCache for Valkey (AWS Database Blog)

Topstep migrated from a self-managed Redis OSS instance to Amazon ElastiCache for Valkey to enhance reliability and performance. The migration involved transferring 53 million keys using RedisShake for a blue/green cutover, followed by a quick DNS change. The move addressed risks associated with a…

How a broken release name overloaded our symbolication database (Sentry Blog)

Sentry faced significant database load due to releases with broken names, leading to high CPU usage and symbolication timeouts. By capping the workload of lookups, they reduced CPU usage from 76% to 19% and timeouts by 98%. The issue stemmed from a problematic Postgres database that could not handle…

Kubernetes Control-Plane Failure Resolved by Addressing Storage Issues and Implementing Validated etcd Backups (dev.to (Kubernetes tag))

A Kubernetes control-plane failure was traced back to a storage subsystem fault that caused etcd database corruption, leading to API unavailability and disrupted pod management. The incident highlighted the need for validated etcd backups and robust recovery strategies in self-managed environments…
Kubernetes News Cloud News DevOps Security News SRE News