On Call Brief – Week of May 10–16, 2026

This week's top stories

1. Cloudflare: 12 Scheduled Maintenance Windows (Network Performance Issues, Los Angeles, Melbourne, Sydney (+8 more))

• Category: Community
• What happened: Cloudflare has resolved network performance issues in Chicago and is monitoring results, according to Cloudflare Status. The company has scheduled extensive datacenter maintenance across multiple regions from May 11-13, 2026, affecting 12 locations including London (LHR), Los Angeles (LAX), Sydney (SYD), Melbourne (MEL), Guangzhou (CAN), Santiago (SCL), Phoenix (PHX), and Montréal (YUL) with maintenance windows ranging from 2 to 14.25 hours. During these maintenance periods, traffic will be rerouted which may cause increased latency for end-users in affected regions. Operators using Private Network Interconnect (PNI) or Cloud Network Interconnect (CNI) should prepare for potential service impacts during their respective regional maintenance windows. Teams should monitor application performance metrics and consider activating backup connectivity or CDN configurations during the scheduled maintenance periods in their regions.
• Worth reading: This incident may have affected users relying on Cloudflare services in the Chicago region, potentially impacting application performance and availability.
• Sources: Cloudflare Status, Cloudflare Status, Cloudflare Status (+9 more)

2. Show HN: I audited my own back ends on 5 BaaS – leak in every one

• Category: Deep Dive
• What happened: The author shares their experience auditing five Backend as a Service (BaaS) platforms, revealing security leaks in each one. The article discusses the findings and implications for developers using these services.
• Takeaway: - Identifying security vulnerabilities in popular BaaS platforms may prompt developers to reassess their reliance on these services and implement additional security measures.
• Source: Github via Hacker News Show HN
• Discussion: https://news.ycombinator.com/item?id=48081289

3. What SRE practice led to more than expected reduction of incidents?

• Category: Community
• What happened: The discussion highlights that better alert tuning has led to a more significant reduction in incidents than implementing new monitoring tools. This suggests that small adjustments in reliability practices can have a substantial impact on incident management.
• Worth reading: Improving alert tuning can enhance response times and reduce noise, which may lead to fewer incidents and better operational efficiency.
• Source: Reddit r/sre

CVE & Security

1. Debian must ship reproducible packages

• Category: Security / Patch
• What happened: The discussion emphasizes the importance of Debian shipping reproducible packages to enhance security and reliability. Reproducible builds allow users to verify that the binaries they receive match the source code, reducing the risk of supply chain attacks.
• Do this Monday: This could affect how packages are built and verified in production environments, potentially improving security practices.
• Source: Lists Debian via Hacker News front page
• Discussion: https://news.ycombinator.com/item?id=48081245

Releases

1. MySQL 9.7: First Major LTS Since 8.4 Brings Enterprise Features to Community Edition

• Category: Release
• What happened: Oracle has released MySQL 9.7.0, initiating a new long-term support (LTS) series, which is the first major release since 8.4. This release comes in response to community concerns regarding the pace of MySQL development and Oracle's commitment to the project.
• Do this Monday: This new LTS version may affect production environments by providing enterprise features to the community edition, potentially improving performance and stability.
• Source: InfoQ DevOps

Lightning links

(No additional items this week.)

Human Stories

Looking across these stories, there's a quiet truth about reliability that often gets overshadowed by the noise of new tools and grand architectures. The Show HN audit revealing leaks in every single BaaS platform reminds us that even managed services aren't magic shields against fundamental security gaps, while Cloudflare's extensive maintenance windows across eleven data centers show us that even the most sophisticated providers still need to do the unglamorous work of keeping infrastructure healthy. But perhaps the most telling insight comes from that SRE discussion about alert tuning - the revelation that thoughtful refinement of what we already have can outperform shiny new monitoring systems entirely. It's a humbling reminder that our greatest wins often come not from adding complexity, but from deeply understanding and carefully tending to the systems we've already built.

Also worth reading

Debian must ship reproducible packages (Hacker News front page)

The discussion emphasizes the importance of Debian shipping reproducible packages to enhance security and reliability. Reproducible builds allow users to verify that the binaries they receive match the source code, reducing the risk of supply chain attacks.

Show HN: I audited my own back ends on 5 BaaS – leak in every one (Hacker News Show HN)

The author shares their experience auditing five Backend as a Service (BaaS) platforms, revealing security leaks in each one. The article discusses the findings and implications for developers using these services.